Add files via upload

2024-06-18 22:41:34 +08:00
1 parent 2551ada3b7
commit 06f5410a4d
@@ -1 +1 @@
-{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 27853809242729492000984914092533936796891917926358854729439436487683423285261, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 60491018752293550079699763462944244393253888103551546202593483014975813742967, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 6759146298068049614085390992799666053918974602489525613718797088468975708017, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 5354562433688861244299028006341553420425390015040147574513776499404802540118, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 817984956081990458969224676381868506770627801582748844000835755782736667191, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 2916561284514958799877078174216081002558870786437593202464334407456915288119, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 14623491695050192413097067629676318500123044497134202517578785087180871258165, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 79047998258892679051555952202178856054614923426747250310189496005785954516966, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707Line truncated
+{"Unknown": [38413146381396798812836662586219087594480760119241756145287379993031670453973, 96759775057307603829199050115151442660431386536877578909394799687553144825391], "White": [92860071170291586757870565976957954052649178883790647665503983139114277816413, 50625869624179221836524636484722091669820057030729734765256925026245308185143, 79303266820014134748061006437377483029320717142203104125806969476209010566146, 50391760446499089493384482654016917630509060287507523223191455177998253781572, 34733894651460458125941968926483828168477919119649839915356573816494375383659, 16447578251589668808184123721615810667991570306415913809506896532563163557975, 18668853151306203943053249777678854424409647574074706653144503993068509738028, 16447129799599854768187525514242197965987640167415805965954293039200573272151, 42965648781535883376480003940402366467478625051031283341289116138472520399484, 45637511530246203537935382208327538642024163565740899790237852717178844340385, 100662025713257198141308144602569453810226448934776598411982222249289646045820, 2813878798545665948450767843887867208740292941021073849284371582085785669685, 54695748401254225125045716155327877471149349614359435230254611073117412307518, 27428665293760567560050957450577436769403462770366418052177943137905489504373, 32018095881556959863902669246154132691484124511748151111295836576906027842532, 82735669648112373508385530969898006750362429118827185652448450648454052106395, 27853809242729492000984914092533936796891917926358854729439436487683423285261, 20030429995379197455160031864140436552884002299333955332088108013764717533796, 82338140557728967648601024370995428985866052631101882076231147335348455671038, 71339449324799277130427957011381342555145697382104653874846579353871764366968, 2432232479351500614611699169184443988440809841079862157291791071419485606436, 9463527399566410848087352636323112952591923803840644609432039785310381355253, 17287926889345790925003722717807755244540044472850272987265624141065166747251, 31507509644511868166890345905396462199402122513677304280568315890707028374136, 92802443753971611323223428952970105040389824130209263287070763891097867755624, 60491018752293550079699763462944244393253888103551546202593483014975813742967, 45133408084728538869955951560598604064861024543940290379768365214821771604584, 6759146298068049614085390992799666053918974602489525613718797088468975708017, 43161770374046173333870752071317153674965637163816017117315179871715332666383, 55200886519442939000007636174371797768786544863806926514781108850256791225983, 102124766481586899841647737641698083212305154684644839980199278690335383712492, 52992286898317605666180786036367620316269750824654214415314225077986227890804, 96307454545313440124283308270263825589093792315386382296096934270155352236733, 36073459579994433898643313577597321150634749356791285363958792075031385371364, 5354562433688861244299028006341553420425390015040147574513776499404802540118, 2671602537216404752611755689384448521170725107261295121211275163689399347529, 31174448189678483951801405655647041557287598300853213718404097030076935043252, 817984956081990458969224676381868506770627801582748844000835755782736667191, 6997953573828232905847825866256444005094471443450029313008738013465446666864, 41288968033780608769032189481784193916730262129846893330891418484950645535282, 56724589038911745751056508177185337741291265472470897077742981563488398484126, 3353938097938067320481103667469354721822387389147415219233498938990215839034, 21195721951654457114265478558602466514207347021822959737607658828495062116920, 2916561284514958799877078174216081002558870786437593202464334407456915288119, 93137488384582768487662730765406914258099784103320160609442537879778117334700, 21195721951654457114265478558602377311225888285332501136798116331518898022972, 85036278951571446667616241901438186945472743486751871120301019617002115253240, 14623491695050192413097067629676318500123044497134202517578785087180871258165, 2022308710750553104057453378681448926020203033444470910346149752954363011822, 16435447118324352510213480738895714506136417806014749563314727656196027207884, 20110908101408861236178371339075650317185505287106087252378028881915405550816, 97262306467112548995108413358594977802790545321935863056096364390382492643957, 96614497885586867524036482497010189662872359368622249290846422070379022959337, 1895288773648887609359329471072769468085207279473521707976899919066265183340, 2651591106060448314208209841614702280337184080195391257416359882876000875095, 114619913163036058498985801603082782363327281628924544162718017899237779173997, 2481883953883130814217575190747389944608730963897863224598923997640828351014, 45000300637061336566799421885334051647634671537987073940268834014403441552901, 79047998258892679051555952202178856054614923426747250310189496005785954516966, 92887093185298651693450115442544102614083847612212241647641096093293220418098, 7140769773119319253009453104401896171570019200295580355390762162793695491644, 17012496707Line truncated
@@ -0,0 +1,403 @@
+import "pe"
+
+rule PYAS_Rules_A_1 {
+   meta:
+      description = "PYAS_Rules_A_1"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "System.Object, mscorlib, Version=" ascii
+      $x2 = ".pdb" ascii
+      $s1 = "a2VybmVsMzIuZGxs" fullword wide
+      $s2 = "RnJlZUNvbnNvbGU=" fullword wide
+      $s3 = "Paleozoologist Timpanist Troubling" ascii
+      $s4 = "Paleozoologist Timpanist Troubling" wide
+      $s5 = "Levitating" fullword ascii
+      $s6 = ".Properties" ascii
+      $s7 = "PublicKeyToken" ascii
+      $s8 = "helpToolStripButton.Image" fullword wide
+      $s9 = "newToolStripButton.Image" fullword wide
+      $s10 = "openToolStripButton.Image" fullword wide
+      $s11 = "printToolStripButton.Image" fullword wide
+      $s12 = "printPreviewToolStripButton.Image" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule PYAS_Rules_A_2 {
+   meta:
+      description = "PYAS_Rules_A_2"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "You walk into the" wide
+      $s2 = "_unprocessedInterAgentMessages" fullword ascii
+      $s3 = "ProcessAllInterAgentMessages" fullword ascii
+      $s4 = "AgentsComunnicationExecution" fullword ascii
+      $s5 = "SendExecuteMessage" fullword ascii
+      $s6 = "TemporarySetAgentModel" fullword ascii
+      $s7 = "immediatelyProcess" fullword ascii
+      $s8 = "ProcessTheMessage" fullword ascii
+      $s9 = "HoldTarget" ascii nocase
+      $s10 = "SimulationEngine." ascii
+      $s11 = "FindAddresseeAgent" ascii
+      $s12 = "AgentIsAlreadyRegistredException" fullword ascii
+      $s13 = "MessageTimestampComparer" fullword ascii
+      $s14 = "startcombat" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 5000KB and
+      8 of them
+}
+
+rule PYAS_Rules_A_3 {
+   meta:
+      description = "PYAS_Rules_A_3"
+      author = "PYAS Security"
+      date = "2024-06-12"
+      hash1 = "0ecf129dfa4e7b5da78c249a38d3e2ca3009aaf2e0203ec779d12aa122904f43"
+   strings:
+      $x1 = "GrapeCity.ActiveReports.Chart.Win" ascii
+      $s1 = "ComponentlessCollectionEditor" ascii
+      $s2 = "LabelsCollectionEditorGrapeCity" ascii
+      $s3 = "AxesEditor" ascii
+      $s4 = "AnnotationEditor" ascii
+      $s5 = "GradientEditor" ascii
+      $s6 = "DoubleArrayEditor" ascii
+      $s7 = "LegendsEditor" ascii
+      $s8 = "DataPointsEditor" ascii
+      $s9 = "ChartAreasEditor" ascii
+      $s10 = "AxesSelectEditor" ascii
+      $s11 = "StyleEditor" ascii
+      $s12 = "PatternEditor" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 22000KB and
+      $x1 and 8 of them
+}
+
+rule PYAS_Rules_A_4 {
+   meta:
+      description = "PYAS_Rules_A4"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = ".Properties" ascii nocase
+      $x2 = ".Resources" ascii nocase
+      $s1 = "ListenToAll" fullword ascii
+      $s2 = "Abberant" fullword ascii
+      $s3 = "Shlyber" fullword ascii
+      $s4 = ".exe" wide
+      $s5 = ".pdb" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 3000KB and
+      ($x1 and $x2) and 5 of them
+}
+
+rule PYAS_Rules_A_5 {
+   meta:
+      description = "PYAS_Rules_A_5"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "Microsoft.VSDesigner.DataSource.Design" ascii
+      $s1 = "columnPostcode" fullword ascii
+      $s2 = "GetRealUpdatedRows" fullword ascii
+      $s3 = "set_Postcode" fullword ascii
+      $s4 = "System.Drawing.Design.UITypeEditor" fullword ascii
+      $s5 = "postcodeDataGridViewTextBoxColumn" fullword wide
+      $s6 = "get_AlexandraDBConnectionString" fullword ascii
+      $s7 = "SELECT [Number]" wide
+      $s8 = "Original_Postcode" fullword wide
+      $s9 = "get_CellPhone" fullword ascii
+      $s10 = "get_CellPhoneColumn" fullword ascii
+      $s11 = "postcodeTextBox" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      $x1 and 3 of them
+}
+
+rule PYAS_Rules_A_6 {
+   meta:
+      description = "PYAS_Rules_A_6"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "System.Drawing" ascii
+      $x2 = "PublicKeyToken" ascii
+      $x3 = "System.Security.Permissions.SecurityPermission" wide
+      $x4 = "urn:schemas-microsoft-com:asm" ascii
+      $s1 = "feffeeffeef" ascii
+      $s2 = "fefefeffefe" ascii
+      $s3 = "feffefeeffe" ascii
+      $s4 = "afeffefeeffea" ascii
+      $s5 = "ffeefeffeefa" ascii
+      $s6 = "ffeeffefeef" ascii
+      $s7 = "ffeeffeeffe" ascii
+      $s8 = "ffefeeffefe" ascii
+      $s9 = "feffefefe" ascii
+      $s10 = "feffeefeffea" ascii
+      $s11 = "affeefefeffe" ascii
+      $s12 = "fefefeffefe" ascii
+      $s13 = "feffefeeffe" ascii
+      $s14 = "ffeeffeefef" ascii
+      $s15 = "fefefeffefea" ascii
+      $s16 = "feffefeeffe" ascii
+      $s17 = "afeffefeeffea" ascii
+      $s18 = "ffeefeffeefa" ascii
+      $s19 = "afefefeffefe" ascii
+      $s20 = "vffefeeffe" fullword ascii
+      $s21 = "afeffefefe" ascii
+      $s22 = "fefefeffea" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule PYAS_Rules_A_7 {
+   meta:
+      description = "PYAS_Rules_A_462"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "python3" ascii nocase
+      $s2 = "_:@:P:H:X:D:T:L:\\:B:R:J:Z:F:V:N:^:A:Q:I:Y:E:U:M:]:C:S:K:[:G:W:O:_" fullword ascii
+      $s3 = "KkdgJiVj1" fullword ascii
+      $s4 = "2V1V5V3V7" fullword ascii
+      $s5 = "Cxz.Yfc" fullword ascii
+      $s6 = "'7 7$7\"7&7!7%7#7'" fullword ascii
+      $s7 = "* %\\5?" fullword ascii
+      $s8 = "xezygjy" fullword ascii
+      $s9 = "tgkvdjv" fullword ascii
+      $s10 = "bfDs /nU," fullword ascii
+      $s11 = "zktmxjuxjeh" fullword ascii
+      $s12 = "indljaj" fullword ascii
+      $s13 = "Z t:\"-" fullword ascii
+      $s14 = "o^EX:\"" fullword ascii
+      $s15 = "rjF.tNb" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 23000KB and
+      6 of them
+}
+
+rule PYAS_Rules_A_8 {
+   meta:
+      description = "PYAS_Rules_A_8"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "TASKKILL /F /IM" wide nocase
+      $x2 = "cmd.exe /c ping 0" wide nocase
+      $x3 = "cmd.exe /k ping 0" wide nocase
+      $s1 = "system32\\SHELL32.dll" wide nocase
+      $s2 = "system32\\mmc.exe" wide nocase
+      $s3 = "Execute ERROR" fullword wide
+      $s4 = "WindowsServiceMode.exe" fullword wide
+      $s5 = "processhacker" fullword wide
+      $s6 = "Microsoft" wide nocase
+      $s7 = "shutdown" wide nocase
+      $s8 = "Download ERROR" fullword wide
+      $s9 = "Executed As " fullword wide
+      $s10 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
+      $s11 = "ScanProcess" fullword ascii
+      $s12 = "HKEY_CURRENT_USER\\Software\\" wide nocase
+      $s13 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\" wide nocase
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule PYAS_Rules_A_9 {
+   meta:
+      description = "PYAS_Rules_A_9"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "$GETPASSWORD1:IDOK" fullword ascii
+      $s2 = "$GETPASSWORD1:SIZE" fullword ascii
+      $s3 = "$GETPASSWORD1:IDC_PASSWORDENTER" fullword ascii
+      $s4 = "$GETPASSWORD1:CAPTION" fullword ascii
+      $s5 = "$GETPASSWORD1:IDCANCEL" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20000KB and
+      5 of them
+}
+
+rule PYAS_Rules_A_10 {
+   meta:
+      description = "PYAS_Rules_A_10"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "DQuasar.Common" ascii
+      $x2 = "PublicKeyToken" ascii
+      $s3 = "Process already elevated." fullword wide
+      $s4 = "get_PotentiallyVulnerablePasswords" ascii
+      $s5 = "GetKeyloggerLogsDirectory" ascii
+      $s6 = "Gma.System.MouseKeyHook.KeyPressEventArgsExt" ascii
+      $s7 = "GetKeyloggerLogsDirectoryResponse" ascii
+      $s8 = "Quasar.Common.Models.FileChunk" ascii
+      $s12 = "set_PotentiallyVulnerablePasswords" ascii
+      $s13 = "potentiallyVulnerablePasswords" ascii
+      $s16 = "getBytesProcessed" ascii
+      $s17 = "GetPreSharedKeyClientHello" ascii
+      $s18 = "GetKeyShareClientHello" ascii
+      $s19 = "GetKeyShareHelloRetryRequest" ascii
+      $s20 = "GetKeyShareServerHello" ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 20000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule PYAS_Rules_A_11 {
+   meta:
+      description = "PYAS_Rules_A_11"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide
+      $s2 = "get_SendSync" fullword ascii
+      $s3 = "get_SslClient" fullword ascii
+      $s4 = "kpTBNFtPhayeH" fullword ascii
+      $s5 = "get_ActivatePong" fullword ascii
+      $s6 = "Pastebin" fullword wide
+      $s7 = "GetUtf8Bytes" fullword ascii
+      $s8 = "Plugin.Plugin" fullword wide
+      $s9 = "RunAntiAnalysis" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 100KB and
+      6 of them
+}
+
+rule PYAS_Rules_A_12 {
+   meta:
+      description = "PYAS_Rules_A_12"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "-ExecutionPolicy Bypass" wide
+      $s1 = "shutdown" wide nocase
+      $s2 = "OfflineKeylogger Not Enabled" fullword wide
+      $s3 = "Win32_Processor.deviceid" wide
+      $s4 = "CloseMutex" fullword ascii
+      $s5 = "AES_Encryptor" fullword ascii
+      $s6 = "POST / HTTP/1.1" fullword wide
+      $s7 = "GetHashT" fullword ascii
+      $s8 = "AES_Decryptor" fullword ascii
+      $s9 = "PCLogoff" fullword wide
+      $s10 = "RunShell" fullword wide
+      $s11 = "HostsMSG" fullword wide
+      $s12 = "HostsErr" fullword wide
+      $s13 = "OfflineGet" fullword wide
+      $s14 = "Content-length:" wide
+	  $s15 = "Mozilla/5.0" wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      1 of ($x*) and 5 of them
+}
+
+rule PYAS_Rules_A_13 {
+   meta:
+      description = "PYAS_Rules_A_13"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "xehook.exe" fullword wide
+      $s2 = "System.Collections.Generic" ascii
+      $s3 = "<xehook.Classes.LogRecord>" ascii
+      $s7 = "Confuser.Core 1.6.0+447341964f" fullword ascii
+      $s8 = "rsqypuz" fullword ascii
+      $s9 = "scyt6m$!k-}qbwu|ud6m#!k-sctbqs6m\"!k-u}q~s`6 -cbud|yv6m!!k-dhu6m !k-~u{" fullword ascii
+      $s10 = "s6m%k-u}q~buce6m$k-cuy{" fullword ascii
+      $s11 = "ETALUME" fullword ascii
+      $s12 = "EYKLLGJCYEHBODMAHOGOCDNCJABEGNCG" fullword ascii
+      $s13 = "JGVIWIWIPUVG" fullword ascii
+      $s14 = "BAAD10E40DF6B5D52A22FCCE498BBD641EBB2377BB7DA4FE04EE26F084647F69" ascii
+      $s15 = "(&'(/- /.,$ $, &  */! .('% ,#$+(" fullword ascii
+      $s16 = "xehook" fullword ascii
+      $s17 = "#+- +e,:'?;;)8" fullword ascii
+      $s18 = "\\DVzVCRz " fullword ascii
+      $s19 = "gv8)  -" fullword ascii
+      $s20 = "[oBxxnhdy[" fullword ascii
+   condition:
+      uint16(0) == 0x5a4d and filesize < 4000KB and
+      6 of them
+}
+
+rule PYAS_Rules_A_14 {
+   meta:
+      description = "PYAS_Rules_A_14"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "jdownloader" wide nocase
+      $s2 = "cmdvrt32.dll" fullword wide
+      $s3 = "accounts.dat" fullword wide
+      $s4 = "SxIn.dll" fullword wide
+      $s5 = "Software\\A.V.M.\\Paltalk NG\\common_settings\\core\\users\\creds\\" fullword wide
+      $s6 = "\\\"(hostname|encryptedPassword|encryptedUsername)\":\"(.*?)\"" fullword wide
+      $s7 = "http://ip-api.com/" wide
+      $s8 = "mRzIs.exe" fullword wide
+      $s9 = "SmtpPassword" fullword wide
+      $s10 = "\\Program Files (x86)\\FTP Commander" wide
+      $s14 = "privateinternetaccess.com" fullword wide
+      $s15 = "paltalk.com" fullword wide
+      $s16 = "discord.com" fullword wide
+      $s17 = "Sf2.dll" fullword wide
+      $s18 = "https://account.dyn.com/" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      6 of them
+}
+
+rule PYAS_Rules_A_15 {
+   meta:
+      description = "PYAS_Rules_A_15"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $s1 = "aGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBn" wide
+      $s2 = "Could not list processes locking resource." wide
+      $s3 = "Failed to get size of result." wide
+      $s4 = "DownloadAndExecuteUpdate" fullword ascii
+      $s5 = "loginusers.vdf" fullword wide
+      $s7 = "SELProcessInfoECT * FRProcessInfoOM Win32_PrProcessInfoocess Where SProcessInfoessionId='" fullword wide
+      $s8 = "get_encrypted_key" fullword ascii
+      $s9 = "Tokens.txt" fullword wide
+      $s10 = "AntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuct" wide
+      $s11 = "VisualPlus-Debug.log" fullword wide
+      $s12 = "Total of RAMExecutablePath" fullword wide
+      $s13 = "loginPairs" fullword ascii
+      $s15 = "Software\\Valve\\SteamLogin Data" fullword wide
+      $s16 = "SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor" fullword wide
+      $s17 = "SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller" fullword wide
+      $s18 = "SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente" fullword wide
+      $s19 = "%localappdata%\\" fullword wide
+      $s20 = "NoEngrdVpEngn.exe*" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 1000KB and
+      6 of them
+}
+
+rule PYAS_Rules_A_16 {
+   meta:
+      description = "PYAS_Rules_A_16"
+      author = "PYAS Security"
+      date = "2024-06-12"
+   strings:
+      $x1 = "LoginForm." ascii
+      $x2 = ".pdb" ascii
+      $s1 = "btnLogin" fullword ascii
+      $s2 = "Wrong ID or Password" fullword wide
+      $s3 = "Log In" wide
+      $s4 = "CodiNauts" wide
+      $s5 = "btnclear" fullword ascii
+      $s6 = "GridFactura.Factura.resources" fullword ascii
+      $s7 = "txtUserID_Validating" fullword ascii
+      $s8 = "TrabajoPractico.GridFactura.resources" fullword ascii
+      $s9 = "txtUserPass" fullword wide
+      $s10 = "txtUserID" fullword wide
+      $s11 = "Please Enter User ID" fullword wide
+   condition:
+      uint16(0) == 0x5a4d and filesize < 2000KB and
+      ($x1 and $x2) and 6 of them
+}