diff --git a/Driver/Protect/Install_Driver.bat b/Driver/Protect/Install_Driver.bat new file mode 100644 index 0000000..7613830 --- /dev/null +++ b/Driver/Protect/Install_Driver.bat @@ -0,0 +1,34 @@ +@echo off +setlocal + +:: Check for permissions +>nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system" + +if %errorlevel% NEQ 0 goto NoAdmin +goto gotAdmin + +:NoAdmin + echo You do not have administrator rights, please run this script as administrator. + pause + exit /B + +:gotAdmin + if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" + +set "script_dir=%~dp0" +set "script_dir=%script_dir:~0,-1%" + +bcdedit -debug on +bcdedit /set testsigning on +bcdedit /deletevalue {current} safeboot + +powershell.exe -ExecutionPolicy Bypass -Command ^ +"$endDate = (Get-Date).AddYears(100); ^ + $cert = New-SelfSignedCertificate -DnsName PYAS -CertStoreLocation cert:\LocalMachine\My -Type CodeSigning -NotAfter $endDate; ^ + $pwd = ConvertTo-SecureString -String 'PYAS' -Force -AsPlainText; ^ + Export-PfxCertificate -Cert $cert -FilePath '%script_dir%\PYAS.pfx' -Password $pwd;" +"%script_dir%\signtool.exe" sign /f "%script_dir%\PYAS.pfx" /p PYAS "%script_dir%\PYAS_Driver.sys" +sc create PYAS_Driver type= kernel start= demand binPath= "%script_dir%\PYAS_Driver.sys" + +shutdown -r -t 0 +endlocal \ No newline at end of file diff --git a/Driver/Protect/PYAS.pfx b/Driver/Protect/PYAS.pfx new file mode 100644 index 0000000..e69de29 diff --git a/Driver/Protect/PYAS_Driver.sys b/Driver/Protect/PYAS_Driver.sys new file mode 100644 index 0000000..0241891 Binary files /dev/null and b/Driver/Protect/PYAS_Driver.sys differ diff --git a/Driver/Protect/Uninstall_Driver.bat b/Driver/Protect/Uninstall_Driver.bat new file mode 100644 index 0000000..b8e9ffb --- /dev/null +++ b/Driver/Protect/Uninstall_Driver.bat @@ -0,0 +1,25 @@ +@echo off +setlocal + +:: Check for permissions +>nul 2>&1 "%SYSTEMROOT%\system32\icacls.exe" "%SYSTEMROOT%\system32\config\system" + +if %errorlevel% NEQ 0 goto NoAdmin +goto gotAdmin + +:NoAdmin + echo You do not have administrator rights, please run this script as administrator. + pause + exit /B + +:gotAdmin + if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" + +sc stop PYAS_Driver +sc delete PYAS_Driver + +bcdedit /set testsigning off +bcdedit -debug off + +shutdown -r -t 0 +endlocal \ No newline at end of file diff --git a/Driver/Protect/signtool.exe b/Driver/Protect/signtool.exe new file mode 100644 index 0000000..1ecf3b3 Binary files /dev/null and b/Driver/Protect/signtool.exe differ diff --git a/Driver/Runtime/VC_redist.x64.exe b/Driver/Runtime/VC_redist.x64.exe new file mode 100644 index 0000000..9ea4955 Binary files /dev/null and b/Driver/Runtime/VC_redist.x64.exe differ diff --git a/Engine/Model/PYAS_Model.json b/Engine/Model/PYAS_Model.json new file mode 100644 index 0000000..f16074c --- /dev/null +++ b/Engine/Model/PYAS_Model.json @@ -0,0 +1,12 @@ +{ + "Suffix": [".com", ".exe", ".dll", ".sys", ".scr", + ".bat", ".cmd", ".ps1", ".vbs", ".wsf"], + + "Labels": ["Pefile/White", "Script/White", "Pefile/General", "Script/General"], + + "Detect": ["Pefile/General", "Script/General"], + + "Pixels": [224, 224], + + "Values": 90 +} diff --git a/Engine/Model/PYAS_Model_A1.onnx b/Engine/Model/PYAS_Model_A1.onnx new file mode 100644 index 0000000..caf1e80 Binary files /dev/null and b/Engine/Model/PYAS_Model_A1.onnx differ diff --git a/Engine/Rules/PYAS_Rules_A1.yar b/Engine/Rules/PYAS_Rules_A1.yar new file mode 100644 index 0000000..d464f2f --- /dev/null +++ b/Engine/Rules/PYAS_Rules_A1.yar @@ -0,0 +1,1472 @@ +import "pe" + +rule General_1 { + meta: + description = "1" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "System.Object, mscorlib, Version=" ascii + $x2 = ".pdb" ascii + $x3 = "System.Drawing" ascii + $s1 = "a2VybmVsMzIuZGxs" fullword wide + $s2 = "RnJlZUNvbnNvbGU=" fullword wide + $s3 = "Paleozoologist Timpanist Troubling" ascii + $s4 = "Paleozoologist Timpanist Troubling" wide + $s5 = "Levitating" fullword ascii + $s6 = ".Properties" ascii + $s7 = "PublicKeyToken" ascii + $s8 = "helpToolStripButton.Image" fullword wide + $s9 = "newToolStripButton.Image" fullword wide + $s10 = "openToolStripButton.Image" fullword wide + $s11 = "printToolStripButton.Image" fullword wide + $s12 = "printPreviewToolStripButton.Image" fullword wide + $s13 = "Extractor" ascii + $s14 = "Congratulations" fullword ascii + $s15 = "Byrnies" fullword wide + $s16 = "showString" fullword ascii + $s17 = "AScsrhgtr" fullword ascii + $s18 = "ZknciocoiAw" fullword ascii + $s19 = "Volute Transitions" fullword wide + $s20 = "IOasuoihciujo" fullword ascii + $s21 = "labelComp" wide + $s22 = "ErrorImage" wide + $s23 = "get_QuestCompletionItems" fullword ascii + $s24 = "get_DropPercentage" fullword ascii + $s25 = "PlayerData.xml" fullword wide + $s26 = "get_LootTable" fullword ascii + $s27 = "get_Potions" ascii + $s28 = "get_CurrentMonster" fullword ascii + $s29 = "MONSTER_ID_RAT" fullword ascii + $s30 = "get_AddExtraNewLine" fullword ascii + $s31 = "get_LootItems" fullword ascii + $s32 = "get_HasAMonster" fullword ascii + $s33 = "get_MinimumDamage" fullword ascii + $s34 = "get_RewardGold" fullword ascii + $s35 = "get_VendorWorkingHere" fullword ascii + $s36 = "get_RewardItem" fullword ascii + $s37 = "get_MaximumDamage" fullword ascii + $s38 = "get_RewardExperiencePoints" fullword ascii + $s39 = "imgur.com" wide + $s40 = "CURD_ALUNOS.md" wide + $s41 = "Parametros.xml" fullword wide + $s42 = "dgEditar_CellContentClick" fullword ascii + $s43 = "dgDados_CellContentClick" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 5000KB and + 1 of ($x*) and 8 of them +} + +rule General_2 { + meta: + description = "2" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "You walk into the" wide + $s2 = "_unprocessedInterAgentMessages" fullword ascii + $s3 = "ProcessAllInterAgentMessages" fullword ascii + $s4 = "AgentsComunnicationExecution" fullword ascii + $s5 = "SendExecuteMessage" fullword ascii + $s6 = "TemporarySetAgentModel" fullword ascii + $s7 = "immediatelyProcess" fullword ascii + $s8 = "ProcessTheMessage" fullword ascii + $s9 = "HoldTarget" ascii nocase + $s10 = "SimulationEngine." ascii + $s11 = "FindAddresseeAgent" ascii + $s12 = "AgentIsAlreadyRegistredException" fullword ascii + $s13 = "MessageTimestampComparer" fullword ascii + $s14 = "startcombat" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 5000KB and + 8 of them +} + +rule General_3 { + meta: + description = "3" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "GrapeCity.ActiveReports.Chart.Win" ascii + $s1 = "ComponentlessCollectionEditor" ascii + $s2 = "LabelsCollectionEditorGrapeCity" ascii + $s3 = "AxesEditor" ascii + $s4 = "AnnotationEditor" ascii + $s5 = "GradientEditor" ascii + $s6 = "DoubleArrayEditor" ascii + $s7 = "LegendsEditor" ascii + $s8 = "DataPointsEditor" ascii + $s9 = "ChartAreasEditor" ascii + $s10 = "AxesSelectEditor" ascii + $s11 = "StyleEditor" ascii + $s12 = "PatternEditor" ascii + condition: + uint16(0) == 0x5a4d and filesize < 30000KB and + $x1 and 8 of them +} + +rule General_4 { + meta: + description = "PYAS_Rules_A4" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = ".Properties" ascii nocase + $x2 = ".Resources" ascii nocase + $s1 = "ListenToAll" fullword ascii + $s2 = "Abberant" fullword ascii + $s3 = "Shlyber" fullword ascii + $s4 = ".exe" wide + $s5 = ".pdb" wide + condition: + uint16(0) == 0x5a4d and filesize < 4000KB and + ($x1 and $x2) and 5 of them +} + +rule General_5 { + meta: + description = "5" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "Microsoft.VSDesigner.DataSource.Design" ascii + $s1 = "columnPostcode" fullword ascii + $s2 = "GetRealUpdatedRows" fullword ascii + $s3 = "set_Postcode" fullword ascii + $s4 = "System.Drawing.Design.UITypeEditor" fullword ascii + $s5 = "postcodeDataGridViewTextBoxColumn" fullword wide + $s6 = "get_AlexandraDBConnectionString" fullword ascii + $s7 = "SELECT [Number]" wide + $s8 = "Original_Postcode" fullword wide + $s9 = "get_CellPhone" fullword ascii + $s10 = "get_CellPhoneColumn" fullword ascii + $s11 = "postcodeTextBox" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 5000KB and + $x1 and 3 of them +} + +rule General_6 { + meta: + description = "6" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "System.Drawing" ascii + $x2 = "PublicKeyToken" ascii + $x3 = "System.Security.Permissions.SecurityPermission" wide + $x4 = "urn:schemas-microsoft-com:asm" ascii + $s1 = "feffeeffeef" ascii + $s2 = "fefefeffefe" ascii + $s3 = "feffefeeffe" ascii + $s4 = "ffeefeffeefa" ascii + $s5 = "ffeeffefeef" ascii + $s6 = "ffeeffeeffe" ascii + $s7 = "ffefeeffefe" ascii + $s8 = "feffefefe" ascii + $s9 = "fefefeffea" ascii + $s10 = "supercommerce@example.com" fullword wide + $s11 = "btnLogin" fullword ascii + $s12 = "loginToolStripMenuItem" fullword wide + $s13 = "loginToolStripMenuItem_Click" fullword ascii + $s14 = "LoginController" fullword ascii + $s15 = "Erro: login Mal Sucedido" fullword wide + $s16 = "Erro de Login" fullword wide + $s17 = "supermercado.Login.resources" fullword ascii + $s18 = "get_Cordinations" fullword ascii + $s19 = "get_Utgivnings" fullword ascii + $s20 = "The Dark Knight" fullword wide + $s21 = "get_Both_Shiled_and_Sword_Hero" fullword ascii + $s22 = "get_Empty_handed_Hero" fullword ascii + $s23 = "LogicValues1" fullword ascii + $s24 = "by adguard" fullword wide + $s25 = "ErrorImage" wide + $s26 = "thedarkknight.jpg" fullword wide + $s27 = "terkomst.jpg" fullword wide + $s28 = "rymdimperiet.jpg" fullword wide + $s29 = "get_Hero_with_shield" fullword ascii + $s30 = "get_PowerOfDistraction" fullword ascii + $s31 = "operationPressed" fullword ascii + $s32 = "get_RadiusOfAttack" fullword ascii + $s33 = "get_FilmNamn" fullword ascii + $s34 = "operatorClick" fullword ascii + $s35 = "get_Hero_with_sword" fullword ascii + $s36 = "CustomImageFormat.txt" wide + $s37 = "get_BeatsPerSecond" fullword ascii + $s38 = "get_BeatPerSecond" fullword ascii + $s39 = "DJ Control" fullword wide + $s40 = "add_BeatChanged" fullword ascii + $s41 = "_presenterModel" fullword ascii + $s42 = "set_BeatsPerSecond" fullword ascii + $s43 = "HandleBeat" fullword ascii + $s44 = "BeatEventArgs" fullword ascii + $s45 = ".NET Framework 4.6l" fullword ascii + $s46 = ".?AV?$IListEnum@PAVECChildEvent@@@bd@@" fullword ascii + $s47 = ".?AV?$_Func_impl_no_alloc@V@@_NABUDllProtectEvent@@@std@@" fullword ascii + $s48 = ".?AV?$_Func_base@_NABUDllProtectEvent@@@std@@" fullword ascii + $s49 = ".?AV?$ListEnum@PAVECChildEvent@@@bd@@" fullword ascii + $s50 = ".?AV?$IConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii + $s51 = ".?AV?$ConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii + $s52 = "labelComp" wide + condition: + uint16(0) == 0x5a4d and filesize < 10000KB and + 1 of ($x*) and 5 of them +} + +rule General_7 { + meta: + description = "7" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "python3" ascii nocase + $s2 = "_:@:P:H:X:D:T:L:\\:B:R:J:Z:F:V:N:^:A:Q:I:Y:E:U:M:]:C:S:K:[:G:W:O:_" fullword ascii + $s3 = "KkdgJiVj1" fullword ascii + $s4 = "2V1V5V3V7" fullword ascii + $s5 = "Cxz.Yfc" fullword ascii + $s6 = "'7 7$7\"7&7!7%7#7'" fullword ascii + $s7 = "* %\\5?" fullword ascii + $s8 = "xezygjy" fullword ascii + $s9 = "tgkvdjv" fullword ascii + $s10 = "bfDs /nU," fullword ascii + $s11 = "zktmxjuxjeh" fullword ascii + $s12 = "indljaj" fullword ascii + $s13 = "Z t:\"-" fullword ascii + $s14 = "o^EX:\"" fullword ascii + $s15 = "rjF.tNb" fullword ascii + $s16 = "pynput.keyboard._dummy)" fullword ascii + $s17 = "pynput.keyboard._darwin)" fullword ascii + $s18 = "pynput.keyboard)" fullword ascii + $s19 = "pynput.keyboard._uinput)" fullword ascii + $s20 = "pynput.keyboard._win32)" fullword ascii + $s21 = "pynput.keyboard._xorg)" fullword ascii + $s22 = "pynput.keyboard._base)" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 50000KB and + 10 of them +} + +rule General_8 { + meta: + description = "8" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "TASKKILL /F /IM" wide nocase + $x2 = "processhacker" wide nocase + $x3 = "cmd.exe /" wide nocase + $s1 = "SHELL32.dll" wide nocase + $s2 = "mmc.exe" wide nocase + $s3 = "Execute ERROR" fullword wide + $s4 = "WindowsServiceMode.exe" fullword wide + $s5 = "ping 0" wide nocase + $s6 = "Microsoft" wide nocase + $s7 = "shutdown" wide nocase + $s8 = "Download ERROR" fullword wide + $s9 = "Executed As " fullword wide + $s10 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide + $s11 = "ScanProcess" fullword ascii + $s12 = "HKEY_CURRENT_USER\\Software\\" wide nocase + $s13 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\" wide nocase + $s14 = "TerminateProcessPath" ascii nocase + $s15 = "svchost.exe" wide nocase + $s16 = "wscript.exe" wide nocase + $s17 = "Application.exe" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 15000KB and + 2 of ($x*) and 6 of them +} + +rule General_9 { + meta: + description = "9" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "SignalEventHandler" fullword ascii + $s2 = "get_CrossTraffic" fullword ascii + $s3 = "get_BeforeIntersection" fullword ascii + $s4 = "get_InIntersection" fullword ascii + $s5 = "get_CloseToIntersection" fullword ascii + $s6 = "TrafficSignal.Settings" fullword ascii + $s7 = "TrafficSignal.Strategy" fullword ascii + $s8 = "TrafficSignal.Serializers" fullword ascii + $s9 = "lblComputerName" fullword wide + $s10 = "TrafficSignal.Properties.Resources.resources" fullword ascii + $s11 = "TrafficSignal.TrafficSignalForm.resources" fullword ascii + $s12 = "TrafficSignal.Properties" fullword ascii + $s13 = "TrafficSignal.Properties.Resources" fullword wide + $s14 = "get_pmYK" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 5000KB and + 6 of them +} + +rule General_10 { + meta: + description = "10" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "DQuasar.Common" ascii + $x2 = "PublicKeyToken" ascii + $s1 = "GetKeyShareHelloRetryRequest" ascii + $s2 = "GetKeyShareServerHello" ascii + $s3 = "Process already elevated." fullword wide + $s4 = "get_PotentiallyVulnerablePasswords" ascii + $s5 = "GetKeyloggerLogsDirectory" ascii + $s6 = "Gma.System.MouseKeyHook.KeyPressEventArgsExt" ascii + $s7 = "GetKeyloggerLogsDirectoryResponse" ascii + $s8 = "Quasar.Common.Models.FileChunk" ascii + $s12 = "set_PotentiallyVulnerablePasswords" ascii + $s13 = "potentiallyVulnerablePasswords" ascii + $s16 = "getBytesProcessed" ascii + $s17 = "GetPreSharedKeyClientHello" ascii + $s18 = "GetKeyShareClientHello" ascii + condition: + uint16(0) == 0x5a4d and filesize < 20000KB and + ($x1 and $x2) and 6 of them +} + +rule General_11 { + meta: + description = "11" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide + $s2 = "get_SendSync" fullword ascii + $s3 = "get_SslClient" fullword ascii + $s4 = "kpTBNFtPhayeH" fullword ascii + $s5 = "get_ActivatePong" fullword ascii + $s6 = "Pastebin" fullword wide + $s7 = "GetUtf8Bytes" fullword ascii + $s8 = "Plugin.Plugin" fullword wide + $s9 = "RunAntiAnalysis" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 1000KB and + 6 of them +} + +rule General_12 { + meta: + description = "12" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "-ExecutionPolicy Bypass" wide + $s1 = "shutdown" wide nocase + $s2 = "OfflineKeylogger Not Enabled" fullword wide + $s3 = "Win32_Processor.deviceid" wide + $s4 = "CloseMutex" fullword ascii + $s5 = "AES_Encryptor" fullword ascii + $s6 = "POST / HTTP/1.1" fullword wide + $s7 = "GetHashT" fullword ascii + $s8 = "AES_Decryptor" fullword ascii + $s9 = "PCLogoff" fullword wide + $s10 = "RunShell" fullword wide + $s11 = "HostsMSG" fullword wide + $s12 = "HostsErr" fullword wide + $s13 = "OfflineGet" fullword wide + $s14 = "Content-length:" wide + $s15 = "Mozilla/5.0" wide + condition: + uint16(0) == 0x5a4d and filesize < 30000KB and + 1 of ($x*) and 5 of them +} + +rule General_13 { + meta: + description = "13" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "xehook.exe" fullword wide + $s2 = "System.Collections.Generic" ascii + $s3 = "" ascii + $s7 = "Confuser.Core 1.6.0+447341964f" fullword ascii + $s8 = "rsqypuz" fullword ascii + $s9 = "scyt6m$!k-}qbwu|ud6m#!k-sctbqs6m\"!k-u}q~s`6 -cbud|yv6m!!k-dhu6m !k-~u{" fullword ascii + $s10 = "s6m%k-u}q~buce6m$k-cuy{" fullword ascii + $s11 = "ETALUME" fullword ascii + $s12 = "EYKLLGJCYEHBODMAHOGOCDNCJABEGNCG" fullword ascii + $s13 = "JGVIWIWIPUVG" fullword ascii + $s14 = "BAAD10E40DF6B5D52A22FCCE498BBD641EBB2377BB7DA4FE04EE26F084647F69" ascii + $s15 = "(&'(/- /.,$ $, & */! .('% ,#$+(" fullword ascii + $s16 = "xehook" fullword ascii + $s17 = "#+- +e,:'?;;)8" fullword ascii + $s18 = "\\DVzVCRz " fullword ascii + $s19 = "gv8) -" fullword ascii + $s20 = "[oBxxnhdy[" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 2000KB and + 6 of them +} + +rule General_14 { + meta: + description = "14" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "jdownloader" wide nocase + $s2 = "cmdvrt32.dll" fullword wide + $s3 = "accounts.dat" fullword wide + $s4 = "SxIn.dll" fullword wide + $s5 = "Paltalk NG" wide + $s6 = "encrypted" fullword wide + $s7 = "ip-api.com" wide + $s8 = "mRzIs.exe" fullword wide + $s9 = "SmtpPassword" fullword wide + $s10 = "FTP Commander" wide + $s14 = "privateinternetaccess.com" fullword wide + $s15 = "paltalk.com" fullword wide + $s16 = "discord.com" fullword wide + $s17 = "Sf2.dll" fullword wide + $s18 = "account.dyn.com" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 2000KB and + 8 of them +} + +rule General_15 { + meta: + description = "15" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "aGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBn" wide + $s2 = "Could not list processes locking resource." wide + $s3 = "Failed to get size of result." wide + $s4 = "DownloadAndExecuteUpdate" fullword ascii + $s5 = "loginusers.vdf" fullword wide + $s7 = "ProcessInfo" wide + $s8 = "get_encrypted_key" fullword ascii + $s9 = "Tokens.txt" fullword wide + $s10 = "DisplayDown" wide + $s11 = "VisualPlus-Debug.log" fullword wide + $s12 = "Total of RAMExecutablePath" fullword wide + $s13 = "loginPairs" fullword ascii + $s15 = "Software\\Valve\\SteamLogin Data" fullword wide + $s16 = "SELSystem" wide + $s17 = "FRSystem" wide + $s18 = "WinSystem" wide + $s19 = "%localappdata%\\" fullword wide + $s20 = "NoEngrdVpEngn.exe*" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 2000KB and + 8 of them +} + +rule General_16 { + meta: + description = "16" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "LoginForm." ascii + $x2 = ".pdb" ascii + $s1 = "btnLogin" fullword ascii + $s2 = "Wrong ID or Password" fullword wide + $s3 = "Log In" wide + $s4 = "CodiNauts" wide + $s5 = "btnclear" fullword ascii + $s6 = "GridFactura.Factura.resources" fullword ascii + $s7 = "txtUserID_Validating" fullword ascii + $s8 = "TrabajoPractico.GridFactura.resources" fullword ascii + $s9 = "txtUserPass" fullword wide + $s10 = "txtUserID" fullword wide + $s11 = "Please Enter User ID" fullword wide + $s12 = "Properties.Resources" ascii + $s13 = "Log In Successfully" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 4000KB and + ($x1 and $x2) and 6 of them +} + +rule General_17 { + meta: + description = "17" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "select * from user" wide nocase + $s1 = "ltromatic.ttf" wide + $s2 = "password mismatch issue" fullword wide + $s3 = "tada.wav" wide + $s4 = "GetAllIncome" fullword ascii + $s5 = "getIcomeData" fullword ascii + $s6 = "execQueryForStoredProcedure" fullword ascii + $s7 = "GetAllIncomeValues" fullword ascii + $s8 = "GetTotalIncomeSum" fullword ascii + $s9 = "getAllUser" fullword ascii + $s10 = "The password must include letters and numbers both" fullword wide + $s11 = "Passwords not mathced" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 4000KB and + $x1 and 8 of them +} + +rule General_18 { + meta: + description = "18" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "WINDESCRIPTION" fullword wide + $s2 = "2#2?2a2{2" fullword ascii + $s3 = "CWM_GETCONTROLNAME" fullword wide + $s4 = ":%:=:C:L:R:\\:g:" fullword ascii + $s5 = ":-:I:T:\\:g:o:{:" fullword ascii + $s6 = "C@COM_EVENTOBJ" fullword wide + $s7 = "ISTABLE" fullword wide + $s8 = "Cstatic" fullword wide + $s9 = "HtZHtEHt2" fullword ascii + $s10 = "tgHuM95" fullword ascii + $s11 = "EEnvironment" fullword wide + $s12 = "Invalid characters behind Object assignment!" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 6000KB and + 6 of them +} + +rule General_19 { + meta: + description = "19" + author = "PYAS Security" + date = "2024-06-12" + strings: + $x1 = "step executed succcessfully" wide + $x2 = "NurseWorkstationDemo" wide + $s1 = "get_ObejctOperation" fullword ascii + $s2 = "man.png" wide + $s3 = "woman.png" fullword wide + $s4 = "get_AUTHORITY_ALL" fullword ascii + $s5 = "GetDataTableInfo_CommonGood" fullword ascii + $s6 = "from CommonGood where user_name=@user_Name" wide + $s7 = "PSYCHOLOGY" fullword ascii + $s8 = "GYNECOLOGY" fullword ascii + $s9 = "Workstation_Library.Common" fullword ascii + $s10 = "get_DataColumn1" fullword ascii + $s11 = "get_DataColumn1Column" fullword ascii + $s12 = "get_DataTable1" fullword ascii + $s13 = "get_Status_R" fullword ascii + $s14 = "GetAllBedNum" fullword ascii + $s15 = "GetDataTableInfo_PatientName" fullword ascii + $s16 = "get_Major_Doctor" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 5000KB and + ($x1 and $x2) and 8 of them +} + +rule General_20 { + meta: + description = "20" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "Log_Clientes.txt" wide + $s2 = "Log_Produtos.txt" wide + $s3 = "Log_Vendas.txt" wide + $s4 = "SCV - Sistema de Cadastro e Vendas" fullword wide + $s5 = "SCV - Novo Cliente" fullword wide + $s6 = "SCV - Lista de Clientes" fullword wide + $s7 = "SCV - Lista de Produtos" fullword wide + $s8 = "SCV - Listar Vendas" fullword wide + $s9 = "SCV - Novo Produto" fullword wide + $s10 = "SCV - Nova Venda" fullword wide + $s11 = "dgvListaClientes_CellContentClick" fullword ascii + $s12 = "Comprador" fullword wide + $s13 = "LogProdutos" fullword ascii + $s14 = "LogVendas" fullword ascii + $s15 = "dgvListaProdutos_CellContentClick" fullword ascii + $s16 = "LogClientes" fullword ascii + $s17 = "Compras" fullword ascii + $s18 = "dgvProdutos_CellContentClick" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 5000KB and + 8 of them +} + +rule General_21 { + meta: + description = "21" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "xeno rat client" wide + $s2 = "Windows Functionality" wide + $s3 = "mutex_string" fullword ascii + $s4 = "5__2" fullword ascii + $s5 = "xeno_rat_client" ascii + $s6 = "_EncryptionKey" fullword ascii + $s7 = "/query /v /fo csv" fullword wide + $s8 = "5__3" fullword ascii + $s9 = "5__2" fullword ascii + $s10 = "GetIdleTimeAsync" ascii + $s11 = "PT0S" wide + $s12 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsICI=" fullword wide + $s13 = "d__5" fullword ascii + $s14 = "5__7" fullword ascii + $s15 = "_dllhandler" fullword ascii + $s16 = "d__3" fullword ascii + condition: + uint16(0) == 0x5a4d and filesize < 500KB and + 8 of them +} + +rule General_22 { + meta: + description = "22" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "Single.exe" fullword wide + $s2 = "Single.pdb" fullword ascii + $s3 = "Overchills" fullword wide + $s4 = "Single.g.resources" fullword ascii + $s5 = "dYuVXzkLLVWbcxpNkzwMQNycwFrMShzJDdw" fullword ascii + $s6 = "ZtrbobDfRVDVSYJDbiTjJYMtnApmznZIIGm" fullword ascii + $s7 = "OmmLUOYnOXYPbQacJiJgtIiOzIZqtuzkkZYgGzISElssPeGNll" fullword wide + $s8 = "RuJwfBUCLwnFkjrsmBeNtwwSyNBZKewfylZFqqPiXRqujAEskL" fullword wide + condition: + uint16(0) == 0x5a4d and filesize < 2000KB and + 6 of them +} + +rule General_23 { + meta: + description = "23" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide + $s2 = "-ItemProperty -Path" wide + $s3 = "Kutc64InaW" fullword ascii + $s4 = "Cronos-Crypter" fullword wide + $s5 = "PrivateImplementationDetails" ascii + $s6 = "SetProcessSecurityDescriptor" ascii + $s7 = "Systemhost" fullword wide + $s8 = "decKey" fullword ascii + $s9 = "StartupInformation" fullword ascii + $s10 = "InstallRegistry" fullword ascii + $s11 = "EEC0C451-6B9A-45A0-A879-90E70D3033F5" ascii + condition: + uint16(0) == 0x5a4d and filesize < 500KB and + 7 of them +} + +rule General_24 { + meta: + description = "24" + author = "PYAS Security" + date = "2024-06-12" + strings: + $s1 = "LcD$`Mi" fullword ascii + $s2 = "yBZh11AY&SYS" fullword ascii + $s3 = "+HcD$DHcL$DH" fullword ascii + $s4 = "D$P9D$@}0" fullword ascii + $s5 = "tkHcD$8H" fullword ascii + $s6 = "BHcD$D" fullword ascii + $s7 = "|$(2t%" fullword ascii + $s8 = "D$ 9D$(}z" fullword ascii + $s9 = "D$ 9D$$}w" fullword ascii + $s10 = "|$02t\"" fullword ascii + $s11 = "L$P9H$s" fullword ascii + $s12 = "L$P9H$|uH" fullword ascii + $s13 = "D$89D$(}," fullword ascii + $s14 = " `l;Vig" fullword ascii + $s15 = "D$@HcL$\\H" fullword ascii + $s16 = "L$p9A