diff --git a/Engine/Model/convert.py b/Engine/Model/convert.py deleted file mode 100644 index b7b3b17..0000000 --- a/Engine/Model/convert.py +++ /dev/null @@ -1,55 +0,0 @@ -from PIL import Image -import numpy, os - -#################################################################################################### - -def preprocess_image(file_data, size, channels=1): - width, height = size - wah = int(numpy.ceil(numpy.sqrt(len(file_data) / channels))) - arr = numpy.frombuffer(file_data, dtype=numpy.uint8) - img = numpy.zeros(wah*wah*channels, dtype=numpy.uint8) - img[:len(file_data)] = arr - image = Image.fromarray(img.reshape((wah, wah)), 'L') - return image.resize((width, height), Image.Resampling.NEAREST) - -#################################################################################################### - -def get_type(file_path): - suffix = {".com", ".dll", ".drv", ".exe", ".ocx", ".scr", ".sys", ".mui", ".cpl"} - try: - file_content = None - if not os.path.splitext(file_path)[-1].lower() in suffix: - return file_content - with open(file_path, 'rb') as f: - file_content = f.read() - except: - pass - return file_content - -#################################################################################################### - -def file_to_images(input_dir, output_dir): - for root, dirs, files in os.walk(input_dir): - for file in files: - try: - file_path = os.path.join(root, file) - file_content = get_type(file_path) - if file_content: - print(file_path) - relative_path = os.path.relpath(root, input_dir) - output_path_dir = os.path.join(output_dir, relative_path) - - if not os.path.exists(output_path_dir): - os.makedirs(output_path_dir) - image = preprocess_image(file_content, (224, 224)) - safe_name = os.path.basename(file_path).replace('/', '_').replace('\\', '_') - image.save(os.path.join(output_path_dir, f"{safe_name}.png")) - except Exception as e: - print(e) - -#################################################################################################### - -input_directory = input('Enter the folder path: ') -output_directory = "./Image_Output" -file_to_images(input_directory, output_directory) -input('Conversion Complete') diff --git a/Engine/Model/deduplicate.py b/Engine/Model/deduplicate.py deleted file mode 100644 index 78697da..0000000 --- a/Engine/Model/deduplicate.py +++ /dev/null @@ -1,34 +0,0 @@ -import os, hashlib - -#################################################################################################### - -def calc_sha256(path): - with open(path, "rb") as f: - return hashlib.sha256(f.read()).digest() - -def dedup_realtime(root): - seen = set() - deleted = 0 - for dirpath, _, files in os.walk(root): - for name in files: - p = os.path.join(dirpath, name) - try: - h = calc_sha256(p) - except Exception: - continue - if h in seen: - try: - os.remove(p) - print(p) - deleted += 1 - except Exception: - pass - else: - seen.add(h) - print(f"deleted {deleted}") - -#################################################################################################### - -if __name__ == "__main__": - dedup_realtime(input("Input file path: ")) -input('Deduplicate Complete') diff --git a/Engine/Model/train.py b/Engine/Model/train.py deleted file mode 100644 index 09f7e20..0000000 --- a/Engine/Model/train.py +++ /dev/null @@ -1,163 +0,0 @@ -import tensorflow as tf -import os, tf2onnx, numpy, random -from PIL import Image -from tensorflow.keras import * -from collections import Counter - -#################################################################################################### - -Image.MAX_IMAGE_PIXELS = None -tf.keras.mixed_precision.set_global_policy('mixed_float16') - -#################################################################################################### - -def load_dataset(data_dir, image_size=(224, 224), val_split=0.00001, batch_size=256, color_mode="grayscale"): - channels = 1 if color_mode == "grayscale" else 3 - file_paths, labels, class_indices = get_file_list(data_dir) - - combined = list(zip(file_paths, labels)) - random.shuffle(combined) - file_paths[:], labels[:] = zip(*combined) - - num_val = int(val_split * len(file_paths)) - train_files = file_paths[num_val:] - train_labels = labels[num_val:] - val_files = file_paths[:num_val] - val_labels = labels[:num_val] - num_classes = len(class_indices) - - train_ds = tf.data.Dataset.from_tensor_slices((train_files, train_labels)) - train_ds = train_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE) - train_ds = train_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE) - - val_ds = tf.data.Dataset.from_tensor_slices((val_files, val_labels)) - val_ds = val_ds.map(lambda f, l: parse_fn(f, l, image_size, channels, num_classes), num_parallel_calls=tf.data.AUTOTUNE) - val_ds = val_ds.batch(batch_size).prefetch(tf.data.AUTOTUNE) - - train_ds.class_indices = class_indices - return train_ds, val_ds - -#################################################################################################### - -def parse_fn(filename, label, image_size, channels, num_classes): - img = tf.io.read_file(filename) - img = tf.image.decode_image(img, channels=channels, expand_animations=False) - img = tf.cond(tf.reduce_all(tf.equal(tf.shape(img)[:2], image_size)), lambda: tf.cast(img, tf.float32), lambda: tf.image.resize(img, image_size)) - img = tf.cast(img, tf.float32) / 255.0 - label = tf.one_hot(label, depth=num_classes) - return img, label - -def get_file_list(directory): - file_paths, labels, class_indices = [], [], {} - for i, cls in enumerate(sorted([d for d in os.listdir(directory) if os.path.isdir(os.path.join(directory, d))])): - class_indices[cls] = i - cls_dir = os.path.join(directory, cls) - - for root, _, files in os.walk(cls_dir): - for file in files: - if file.lower().endswith(('.jpg', '.jpeg', '.png', '.bmp', '.gif')): - file_paths.append(os.path.join(root, file)) - labels.append(i) - return file_paths, labels, class_indices - -#################################################################################################### - -def multi_conv(x, strides): - convs = [] - for k in [(1, 7), (1, 1), (3, 3), (5, 5)]: - c = layers.DepthwiseConv2D(kernel_size=k, strides=strides, padding='same', activation='gelu')(x) - convs.append(c) - - x = layers.Concatenate()(convs) - x = layers.BatchNormalization()(x) - return layers.Activation('gelu')(x) - -def gated_conv(x, strides): - c = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='gelu')(x) - g = layers.DepthwiseConv2D(3, strides=strides, padding='same', activation='sigmoid')(x) - return layers.Multiply()([c, g]) - -def coordinate_attention(x, reduction): - input_shape = tf.shape(x) - h, w = input_shape[1], input_shape[2] - filters = x.shape[-1] - mip = max(8, filters // reduction) - - x_h = layers.Lambda(lambda t: tf.reduce_mean(t, axis=2, keepdims=True))(x) - x_w = layers.Lambda(lambda t: tf.reduce_mean(t, axis=1, keepdims=True))(x) - x_w_t = layers.Permute((2, 1, 3))(x_w) - - x_cat = layers.Concatenate(axis=1)([x_h, x_w_t]) - x_cat = layers.Conv2D(mip, 1, padding='valid', use_bias=False)(x_cat) - x_cat = layers.BatchNormalization()(x_cat) - x_cat = layers.Activation('gelu')(x_cat) - - x_cat_h, x_cat_w = layers.Lambda(lambda t: tf.split(t[0], [t[1], t[2]], axis=1))([x_cat, h, w]) - x_h_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_h) - x_cat_w = layers.Permute((2, 1, 3))(x_cat_w) - x_w_sigmoid = layers.Conv2D(filters, 1, padding='valid', activation='sigmoid')(x_cat_w) - - return layers.Multiply()([x, x_h_sigmoid, x_w_sigmoid]) - -def build_model(input_shape, num_classes): - i = layers.Input(shape=input_shape) - x = multi_conv(i, strides=1) - x = gated_conv(x, strides=2) - x = multi_conv(x, strides=2) - x = multi_conv(x, strides=2) - x = multi_conv(x, strides=2) - x = multi_conv(x, strides=2) - - x = coordinate_attention(x, reduction=4) - x = layers.GlobalMaxPooling2D()(x) - - x = layers.Dense(x.shape[-1] // 2, activation='gelu', dtype='float32')(x) - o = layers.Dense(num_classes, activation='softmax', dtype='float32')(x) - return models.Model(i, o) - -#################################################################################################### - -def calculate_lr_cosine_sq(epoch, total_epochs=30, lr_start=5e-4, lr_end=5e-7): - cos_val = 0.5 * (1 + numpy.cos(epoch / total_epochs * numpy.pi)) - return lr_end + (lr_start - lr_end) * (cos_val ** 2) - -def lr_scheduler(epoch): - return calculate_lr_cosine_sq(epoch) - -def categorical_focal_loss(gamma=2.0, alpha=0.25): - def focal_loss(y_true, y_pred): - y_pred = tf.clip_by_value(y_pred, tf.keras.backend.epsilon(), 1.0 - tf.keras.backend.epsilon()) - cross_entropy = -y_true * tf.math.log(y_pred) - loss = alpha * tf.math.pow(1.0 - y_pred, gamma) * cross_entropy - return tf.reduce_sum(loss, axis=-1) - return focal_loss - -class CustomModelCheckpoint(callbacks.Callback): - def on_epoch_end(self, epoch, logs=False): - models.save_model(self.model, f"PYAS_Model_Epoch_{epoch + 1}.h5") - spec = (tf.TensorSpec((None,) + train_ds.image_shape, tf.float32),) - model_proto, _ = tf2onnx.convert.from_keras(self.model, input_signature=spec, opset=17) - with open(f"PYAS_Model_Epoch_{epoch + 1}.onnx", "wb") as f: - f.write(model_proto.SerializeToString()) - -#################################################################################################### - -train_ds, val_ds = load_dataset(r'.\Image_Full_Pefile') -for imgs, _ in train_ds.take(1): - train_ds.image_shape = imgs.shape[1:] - break - -try: - model = models.load_model('PYAS_Model_Epoch_0.h5') - print("Load model from disk") -except: - print("Creating a new model") - model = build_model(train_ds.image_shape, len(train_ds.class_indices)) - -print(f"Total parameters: {model.count_params()}") -model.compile(optimizer='adam', loss=categorical_focal_loss(gamma=2.0, alpha=0.25), - metrics=['accuracy', metrics.Precision(name='precision'), metrics.Recall(name='recall'), - metrics.FalsePositives(name='fp'), metrics.TrueNegatives(name='tn')]) - -model.fit(train_ds, epochs=30, callbacks=[CustomModelCheckpoint(), callbacks.LearningRateScheduler(lr_scheduler)], validation_data=val_ds) -input('Training Complete') diff --git a/Engine/Rules/PYAS_Rules_A1.yar b/Engine/Rules/PYAS_Rules_A1.yar deleted file mode 100644 index bc7a446..0000000 --- a/Engine/Rules/PYAS_Rules_A1.yar +++ /dev/null @@ -1,1439 +0,0 @@ -import "pe" - -rule General_1 { - meta: - description = "1" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "System.Object, mscorlib, Version=" ascii - $x2 = ".pdb" ascii - $x3 = "System.Drawing" ascii - $s1 = "a2VybmVsMzIuZGxs" fullword wide - $s2 = "RnJlZUNvbnNvbGU=" fullword wide - $s3 = "Paleozoologist Timpanist Troubling" ascii - $s4 = "Paleozoologist Timpanist Troubling" wide - $s5 = "Levitating" fullword ascii - $s6 = ".Properties" ascii - $s7 = "PublicKeyToken" ascii - $s8 = "helpToolStripButton.Image" fullword wide - $s9 = "newToolStripButton.Image" fullword wide - $s10 = "openToolStripButton.Image" fullword wide - $s11 = "printToolStripButton.Image" fullword wide - $s12 = "printPreviewToolStripButton.Image" fullword wide - $s13 = "Extractor" ascii - $s14 = "Congratulations" fullword ascii - $s15 = "Byrnies" fullword wide - $s16 = "showString" fullword ascii - $s17 = "AScsrhgtr" fullword ascii - $s18 = "ZknciocoiAw" fullword ascii - $s19 = "Volute Transitions" fullword wide - $s20 = "IOasuoihciujo" fullword ascii - $s21 = "labelComp" wide - $s22 = "ErrorImage" wide - $s23 = "get_QuestCompletionItems" fullword ascii - $s24 = "get_DropPercentage" fullword ascii - $s25 = "PlayerData.xml" fullword wide - $s26 = "get_LootTable" fullword ascii - $s27 = "get_Potions" ascii - $s28 = "get_CurrentMonster" fullword ascii - $s29 = "MONSTER_ID_RAT" fullword ascii - $s30 = "get_AddExtraNewLine" fullword ascii - $s31 = "get_LootItems" fullword ascii - $s32 = "get_HasAMonster" fullword ascii - $s33 = "get_MinimumDamage" fullword ascii - $s34 = "get_RewardGold" fullword ascii - $s35 = "get_VendorWorkingHere" fullword ascii - $s36 = "get_RewardItem" fullword ascii - $s37 = "get_MaximumDamage" fullword ascii - $s38 = "get_RewardExperiencePoints" fullword ascii - $s39 = "imgur.com" wide - $s40 = "CURD_ALUNOS.md" wide - $s41 = "Parametros.xml" fullword wide - $s42 = "dgEditar_CellContentClick" fullword ascii - $s43 = "dgDados_CellContentClick" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 1 of ($x*) and 8 of them -} - -rule General_2 { - meta: - description = "2" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "You walk into the" wide - $s2 = "_unprocessedInterAgentMessages" fullword ascii - $s3 = "ProcessAllInterAgentMessages" fullword ascii - $s4 = "AgentsComunnicationExecution" fullword ascii - $s5 = "SendExecuteMessage" fullword ascii - $s6 = "TemporarySetAgentModel" fullword ascii - $s7 = "immediatelyProcess" fullword ascii - $s8 = "ProcessTheMessage" fullword ascii - $s9 = "HoldTarget" ascii nocase - $s10 = "SimulationEngine." ascii - $s11 = "FindAddresseeAgent" ascii - $s12 = "AgentIsAlreadyRegistredException" fullword ascii - $s13 = "MessageTimestampComparer" fullword ascii - $s14 = "startcombat" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 8 of them -} - -rule General_3 { - meta: - description = "3" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "GrapeCity.ActiveReports.Chart.Win" ascii - $s1 = "ComponentlessCollectionEditor" ascii - $s2 = "LabelsCollectionEditorGrapeCity" ascii - $s3 = "AxesEditor" ascii - $s4 = "AnnotationEditor" ascii - $s5 = "GradientEditor" ascii - $s6 = "DoubleArrayEditor" ascii - $s7 = "LegendsEditor" ascii - $s8 = "DataPointsEditor" ascii - $s9 = "ChartAreasEditor" ascii - $s10 = "AxesSelectEditor" ascii - $s11 = "StyleEditor" ascii - $s12 = "PatternEditor" ascii - condition: - uint16(0) == 0x5a4d and filesize < 30000KB and - $x1 and 8 of them -} - -rule General_4 { - meta: - description = "PYAS_Rules_A4" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = ".Properties" ascii nocase - $x2 = ".Resources" ascii nocase - $s1 = "ListenToAll" fullword ascii - $s2 = "Abberant" fullword ascii - $s3 = "Shlyber" fullword ascii - $s4 = ".exe" wide - $s5 = ".pdb" wide - condition: - uint16(0) == 0x5a4d and filesize < 4000KB and - ($x1 and $x2) and 5 of them -} - -rule General_5 { - meta: - description = "5" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "Microsoft.VSDesigner.DataSource.Design" ascii - $s1 = "columnPostcode" fullword ascii - $s2 = "GetRealUpdatedRows" fullword ascii - $s3 = "set_Postcode" fullword ascii - $s4 = "System.Drawing.Design.UITypeEditor" fullword ascii - $s5 = "postcodeDataGridViewTextBoxColumn" fullword wide - $s6 = "get_AlexandraDBConnectionString" fullword ascii - $s7 = "SELECT [Number]" wide - $s8 = "Original_Postcode" fullword wide - $s9 = "get_CellPhone" fullword ascii - $s10 = "get_CellPhoneColumn" fullword ascii - $s11 = "postcodeTextBox" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - $x1 and 3 of them -} - -rule General_6 { - meta: - description = "6" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "System.Drawing" ascii - $x2 = "PublicKeyToken" ascii - $x3 = "System.Security.Permissions.SecurityPermission" wide - $x4 = "urn:schemas-microsoft-com:asm" ascii - $s1 = "feffeeffeef" ascii - $s2 = "fefefeffefe" ascii - $s3 = "feffefeeffe" ascii - $s4 = "ffeefeffeefa" ascii - $s5 = "ffeeffefeef" ascii - $s6 = "ffeeffeeffe" ascii - $s7 = "ffefeeffefe" ascii - $s8 = "feffefefe" ascii - $s9 = "fefefeffea" ascii - $s10 = "supercommerce@example.com" fullword wide - $s11 = "btnLogin" fullword ascii - $s12 = "loginToolStripMenuItem" fullword wide - $s13 = "loginToolStripMenuItem_Click" fullword ascii - $s14 = "LoginController" fullword ascii - $s15 = "Erro: login Mal Sucedido" fullword wide - $s16 = "Erro de Login" fullword wide - $s17 = "supermercado.Login.resources" fullword ascii - $s18 = "get_Cordinations" fullword ascii - $s19 = "get_Utgivnings" fullword ascii - $s20 = "The Dark Knight" fullword wide - $s21 = "get_Both_Shiled_and_Sword_Hero" fullword ascii - $s22 = "get_Empty_handed_Hero" fullword ascii - $s23 = "LogicValues1" fullword ascii - $s24 = "by adguard" fullword wide - $s25 = "ErrorImage" wide - $s26 = "thedarkknight.jpg" fullword wide - $s27 = "terkomst.jpg" fullword wide - $s28 = "rymdimperiet.jpg" fullword wide - $s29 = "get_Hero_with_shield" fullword ascii - $s30 = "get_PowerOfDistraction" fullword ascii - $s31 = "operationPressed" fullword ascii - $s32 = "get_RadiusOfAttack" fullword ascii - $s33 = "get_FilmNamn" fullword ascii - $s34 = "operatorClick" fullword ascii - $s35 = "get_Hero_with_sword" fullword ascii - $s36 = "CustomImageFormat.txt" wide - $s37 = "get_BeatsPerSecond" fullword ascii - $s38 = "get_BeatPerSecond" fullword ascii - $s39 = "DJ Control" fullword wide - $s40 = "add_BeatChanged" fullword ascii - $s41 = "_presenterModel" fullword ascii - $s42 = "set_BeatsPerSecond" fullword ascii - $s43 = "HandleBeat" fullword ascii - $s44 = "BeatEventArgs" fullword ascii - $s45 = ".NET Framework 4.6l" fullword ascii - $s46 = ".?AV?$IListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s47 = ".?AV?$_Func_impl_no_alloc@V@@_NABUDllProtectEvent@@@std@@" fullword ascii - $s48 = ".?AV?$_Func_base@_NABUDllProtectEvent@@@std@@" fullword ascii - $s49 = ".?AV?$ListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s50 = ".?AV?$IConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s51 = ".?AV?$ConstListEnum@PAVECChildEvent@@@bd@@" fullword ascii - $s52 = "labelComp" wide - condition: - uint16(0) == 0x5a4d and filesize < 10000KB and - 1 of ($x*) and 5 of them -} - -rule General_7 { - meta: - description = "7" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "python3" ascii nocase - $s2 = "_:@:P:H:X:D:T:L:\\:B:R:J:Z:F:V:N:^:A:Q:I:Y:E:U:M:]:C:S:K:[:G:W:O:_" fullword ascii - $s3 = "KkdgJiVj1" fullword ascii - $s4 = "2V1V5V3V7" fullword ascii - $s5 = "Cxz.Yfc" fullword ascii - $s6 = "'7 7$7\"7&7!7%7#7'" fullword ascii - $s7 = "* %\\5?" fullword ascii - $s8 = "xezygjy" fullword ascii - $s9 = "tgkvdjv" fullword ascii - $s10 = "bfDs /nU," fullword ascii - $s11 = "zktmxjuxjeh" fullword ascii - $s12 = "indljaj" fullword ascii - $s13 = "Z t:\"-" fullword ascii - $s14 = "o^EX:\"" fullword ascii - $s15 = "rjF.tNb" fullword ascii - $s16 = "pynput.keyboard._dummy)" fullword ascii - $s17 = "pynput.keyboard._darwin)" fullword ascii - $s18 = "pynput.keyboard)" fullword ascii - $s19 = "pynput.keyboard._uinput)" fullword ascii - $s20 = "pynput.keyboard._win32)" fullword ascii - $s21 = "pynput.keyboard._xorg)" fullword ascii - $s22 = "pynput.keyboard._base)" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 50000KB and - 10 of them -} - -rule General_8 { - meta: - description = "8" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "TASKKILL /F /IM" wide nocase - $x2 = "processhacker" wide nocase - $x3 = "cmd.exe /" wide nocase - $s1 = "SHELL32.dll" wide nocase - $s2 = "mmc.exe" wide nocase - $s3 = "Execute ERROR" fullword wide - $s4 = "WindowsServiceMode.exe" fullword wide - $s5 = "ping 0" wide nocase - $s6 = "Microsoft" wide nocase - $s7 = "shutdown" wide nocase - $s8 = "Download ERROR" fullword wide - $s9 = "Executed As " fullword wide - $s10 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide - $s11 = "ScanProcess" fullword ascii - $s12 = "HKEY_CURRENT_USER\\Software\\" wide nocase - $s13 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\" wide nocase - $s14 = "TerminateProcessPath" ascii nocase - $s15 = "svchost.exe" wide nocase - $s16 = "wscript.exe" wide nocase - $s17 = "Application.exe" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 15000KB and - 2 of ($x*) and 6 of them -} - -rule General_9 { - meta: - description = "9" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "SignalEventHandler" fullword ascii - $s2 = "get_CrossTraffic" fullword ascii - $s3 = "get_BeforeIntersection" fullword ascii - $s4 = "get_InIntersection" fullword ascii - $s5 = "get_CloseToIntersection" fullword ascii - $s6 = "TrafficSignal.Settings" fullword ascii - $s7 = "TrafficSignal.Strategy" fullword ascii - $s8 = "TrafficSignal.Serializers" fullword ascii - $s9 = "lblComputerName" fullword wide - $s10 = "TrafficSignal.Properties.Resources.resources" fullword ascii - $s11 = "TrafficSignal.TrafficSignalForm.resources" fullword ascii - $s12 = "TrafficSignal.Properties" fullword ascii - $s13 = "TrafficSignal.Properties.Resources" fullword wide - $s14 = "get_pmYK" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 6 of them -} - -rule General_10 { - meta: - description = "10" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "DQuasar.Common" ascii - $x2 = "PublicKeyToken" ascii - $s1 = "GetKeyShareHelloRetryRequest" ascii - $s2 = "GetKeyShareServerHello" ascii - $s3 = "Process already elevated." fullword wide - $s4 = "get_PotentiallyVulnerablePasswords" ascii - $s5 = "GetKeyloggerLogsDirectory" ascii - $s6 = "Gma.System.MouseKeyHook.KeyPressEventArgsExt" ascii - $s7 = "GetKeyloggerLogsDirectoryResponse" ascii - $s8 = "Quasar.Common.Models.FileChunk" ascii - $s12 = "set_PotentiallyVulnerablePasswords" ascii - $s13 = "potentiallyVulnerablePasswords" ascii - $s16 = "getBytesProcessed" ascii - $s17 = "GetPreSharedKeyClientHello" ascii - $s18 = "GetKeyShareClientHello" ascii - condition: - uint16(0) == 0x5a4d and filesize < 20000KB and - ($x1 and $x2) and 6 of them -} - -rule General_11 { - meta: - description = "11" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide - $s2 = "get_SendSync" fullword ascii - $s3 = "get_SslClient" fullword ascii - $s4 = "kpTBNFtPhayeH" fullword ascii - $s5 = "get_ActivatePong" fullword ascii - $s6 = "Pastebin" fullword wide - $s7 = "GetUtf8Bytes" fullword ascii - $s8 = "Plugin.Plugin" fullword wide - $s9 = "RunAntiAnalysis" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 1000KB and - 6 of them -} - -rule General_12 { - meta: - description = "12" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "-ExecutionPolicy Bypass" wide - $s1 = "shutdown" wide nocase - $s2 = "OfflineKeylogger Not Enabled" fullword wide - $s3 = "Win32_Processor.deviceid" wide - $s4 = "CloseMutex" fullword ascii - $s5 = "AES_Encryptor" fullword ascii - $s6 = "POST / HTTP/1.1" fullword wide - $s7 = "GetHashT" fullword ascii - $s8 = "AES_Decryptor" fullword ascii - $s9 = "PCLogoff" fullword wide - $s10 = "RunShell" fullword wide - $s11 = "HostsMSG" fullword wide - $s12 = "HostsErr" fullword wide - $s13 = "OfflineGet" fullword wide - $s14 = "Content-length:" wide - $s15 = "Mozilla/5.0" wide - condition: - uint16(0) == 0x5a4d and filesize < 30000KB and - 1 of ($x*) and 5 of them -} - -rule General_13 { - meta: - description = "13" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "xehook.exe" fullword wide - $s2 = "System.Collections.Generic" ascii - $s3 = "" ascii - $s7 = "Confuser.Core 1.6.0+447341964f" fullword ascii - $s8 = "rsqypuz" fullword ascii - $s9 = "scyt6m$!k-}qbwu|ud6m#!k-sctbqs6m\"!k-u}q~s`6 -cbud|yv6m!!k-dhu6m !k-~u{" fullword ascii - $s10 = "s6m%k-u}q~buce6m$k-cuy{" fullword ascii - $s11 = "ETALUME" fullword ascii - $s12 = "EYKLLGJCYEHBODMAHOGOCDNCJABEGNCG" fullword ascii - $s13 = "JGVIWIWIPUVG" fullword ascii - $s14 = "BAAD10E40DF6B5D52A22FCCE498BBD641EBB2377BB7DA4FE04EE26F084647F69" ascii - $s15 = "(&'(/- /.,$ $, & */! .('% ,#$+(" fullword ascii - $s16 = "xehook" fullword ascii - $s17 = "#+- +e,:'?;;)8" fullword ascii - $s18 = "\\DVzVCRz " fullword ascii - $s19 = "gv8) -" fullword ascii - $s20 = "[oBxxnhdy[" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 6 of them -} - -rule General_14 { - meta: - description = "14" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "jdownloader" wide nocase - $s2 = "cmdvrt32.dll" fullword wide - $s3 = "accounts.dat" fullword wide - $s4 = "SxIn.dll" fullword wide - $s5 = "Paltalk NG" wide - $s6 = "encrypted" fullword wide - $s7 = "ip-api.com" wide - $s8 = "mRzIs.exe" fullword wide - $s9 = "SmtpPassword" fullword wide - $s10 = "FTP Commander" wide - $s14 = "privateinternetaccess.com" fullword wide - $s15 = "paltalk.com" fullword wide - $s16 = "discord.com" fullword wide - $s17 = "Sf2.dll" fullword wide - $s18 = "account.dyn.com" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 8 of them -} - -rule General_15 { - meta: - description = "15" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "aGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBn" wide - $s2 = "Could not list processes locking resource." wide - $s3 = "Failed to get size of result." wide - $s4 = "DownloadAndExecuteUpdate" fullword ascii - $s5 = "loginusers.vdf" fullword wide - $s7 = "ProcessInfo" wide - $s8 = "get_encrypted_key" fullword ascii - $s9 = "Tokens.txt" fullword wide - $s10 = "DisplayDown" wide - $s11 = "VisualPlus-Debug.log" fullword wide - $s12 = "Total of RAMExecutablePath" fullword wide - $s13 = "loginPairs" fullword ascii - $s15 = "Software\\Valve\\SteamLogin Data" fullword wide - $s16 = "SELSystem" wide - $s17 = "FRSystem" wide - $s18 = "WinSystem" wide - $s19 = "%localappdata%\\" fullword wide - $s20 = "NoEngrdVpEngn.exe*" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 8 of them -} - -rule General_16 { - meta: - description = "16" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "LoginForm." ascii - $x2 = ".pdb" ascii - $s1 = "btnLogin" fullword ascii - $s2 = "Wrong ID or Password" fullword wide - $s3 = "Log In" wide - $s4 = "CodiNauts" wide - $s5 = "btnclear" fullword ascii - $s6 = "GridFactura.Factura.resources" fullword ascii - $s7 = "txtUserID_Validating" fullword ascii - $s8 = "TrabajoPractico.GridFactura.resources" fullword ascii - $s9 = "txtUserPass" fullword wide - $s10 = "txtUserID" fullword wide - $s11 = "Please Enter User ID" fullword wide - $s12 = "Properties.Resources" ascii - $s13 = "Log In Successfully" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 4000KB and - ($x1 and $x2) and 6 of them -} - -rule General_17 { - meta: - description = "17" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "select * from user" wide nocase - $s1 = "ltromatic.ttf" wide - $s2 = "password mismatch issue" fullword wide - $s3 = "tada.wav" wide - $s4 = "GetAllIncome" fullword ascii - $s5 = "getIcomeData" fullword ascii - $s6 = "execQueryForStoredProcedure" fullword ascii - $s7 = "GetAllIncomeValues" fullword ascii - $s8 = "GetTotalIncomeSum" fullword ascii - $s9 = "getAllUser" fullword ascii - $s10 = "The password must include letters and numbers both" fullword wide - $s11 = "Passwords not mathced" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 4000KB and - $x1 and 8 of them -} - -rule General_18 { - meta: - description = "18" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "WINDESCRIPTION" fullword wide - $s2 = "2#2?2a2{2" fullword ascii - $s3 = "CWM_GETCONTROLNAME" fullword wide - $s4 = ":%:=:C:L:R:\\:g:" fullword ascii - $s5 = ":-:I:T:\\:g:o:{:" fullword ascii - $s6 = "C@COM_EVENTOBJ" fullword wide - $s7 = "ISTABLE" fullword wide - $s8 = "Cstatic" fullword wide - $s9 = "HtZHtEHt2" fullword ascii - $s10 = "tgHuM95" fullword ascii - $s11 = "EEnvironment" fullword wide - $s12 = "Invalid characters behind Object assignment!" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 6000KB and - 6 of them -} - -rule General_19 { - meta: - description = "19" - author = "PYAS Security" - date = "2024-06-12" - strings: - $x1 = "step executed succcessfully" wide - $x2 = "NurseWorkstationDemo" wide - $s1 = "get_ObejctOperation" fullword ascii - $s2 = "man.png" wide - $s3 = "woman.png" fullword wide - $s4 = "get_AUTHORITY_ALL" fullword ascii - $s5 = "GetDataTableInfo_CommonGood" fullword ascii - $s6 = "from CommonGood where user_name=@user_Name" wide - $s7 = "PSYCHOLOGY" fullword ascii - $s8 = "GYNECOLOGY" fullword ascii - $s9 = "Workstation_Library.Common" fullword ascii - $s10 = "get_DataColumn1" fullword ascii - $s11 = "get_DataColumn1Column" fullword ascii - $s12 = "get_DataTable1" fullword ascii - $s13 = "get_Status_R" fullword ascii - $s14 = "GetAllBedNum" fullword ascii - $s15 = "GetDataTableInfo_PatientName" fullword ascii - $s16 = "get_Major_Doctor" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - ($x1 and $x2) and 8 of them -} - -rule General_20 { - meta: - description = "20" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "Log_Clientes.txt" wide - $s2 = "Log_Produtos.txt" wide - $s3 = "Log_Vendas.txt" wide - $s4 = "SCV - Sistema de Cadastro e Vendas" fullword wide - $s5 = "SCV - Novo Cliente" fullword wide - $s6 = "SCV - Lista de Clientes" fullword wide - $s7 = "SCV - Lista de Produtos" fullword wide - $s8 = "SCV - Listar Vendas" fullword wide - $s9 = "SCV - Novo Produto" fullword wide - $s10 = "SCV - Nova Venda" fullword wide - $s11 = "dgvListaClientes_CellContentClick" fullword ascii - $s12 = "Comprador" fullword wide - $s13 = "LogProdutos" fullword ascii - $s14 = "LogVendas" fullword ascii - $s15 = "dgvListaProdutos_CellContentClick" fullword ascii - $s16 = "LogClientes" fullword ascii - $s17 = "Compras" fullword ascii - $s18 = "dgvProdutos_CellContentClick" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 5000KB and - 8 of them -} - -rule General_21 { - meta: - description = "21" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "xeno rat client" wide - $s2 = "Windows Functionality" wide - $s3 = "mutex_string" fullword ascii - $s4 = "5__2" fullword ascii - $s5 = "xeno_rat_client" ascii - $s6 = "_EncryptionKey" fullword ascii - $s7 = "/query /v /fo csv" fullword wide - $s8 = "5__3" fullword ascii - $s9 = "5__2" fullword ascii - $s10 = "GetIdleTimeAsync" ascii - $s11 = "PT0S" wide - $s12 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsICI=" fullword wide - $s13 = "d__5" fullword ascii - $s14 = "5__7" fullword ascii - $s15 = "_dllhandler" fullword ascii - $s16 = "d__3" fullword ascii - condition: - uint16(0) == 0x5a4d and filesize < 500KB and - 8 of them -} - -rule General_22 { - meta: - description = "22" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "Single.exe" fullword wide - $s2 = "Single.pdb" fullword ascii - $s3 = "Overchills" fullword wide - $s4 = "Single.g.resources" fullword ascii - $s5 = "dYuVXzkLLVWbcxpNkzwMQNycwFrMShzJDdw" fullword ascii - $s6 = "ZtrbobDfRVDVSYJDbiTjJYMtnApmznZIIGm" fullword ascii - $s7 = "OmmLUOYnOXYPbQacJiJgtIiOzIZqtuzkkZYgGzISElssPeGNll" fullword wide - $s8 = "RuJwfBUCLwnFkjrsmBeNtwwSyNBZKewfylZFqqPiXRqujAEskL" fullword wide - condition: - uint16(0) == 0x5a4d and filesize < 2000KB and - 6 of them -} - -rule General_23 { - meta: - description = "23" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide - $s2 = "-ItemProperty -Path" wide - $s3 = "Kutc64InaW" fullword ascii - $s4 = "Cronos-Crypter" fullword wide - $s5 = "PrivateImplementationDetails" ascii - $s6 = "SetProcessSecurityDescriptor" ascii - $s7 = "Systemhost" fullword wide - $s8 = "decKey" fullword ascii - $s9 = "StartupInformation" fullword ascii - $s10 = "InstallRegistry" fullword ascii - $s11 = "EEC0C451-6B9A-45A0-A879-90E70D3033F5" ascii - condition: - uint16(0) == 0x5a4d and filesize < 500KB and - 7 of them -} - -rule General_24 { - meta: - description = "24" - author = "PYAS Security" - date = "2024-06-12" - strings: - $s1 = "LcD$`Mi" fullword ascii - $s2 = "yBZh11AY&SYS" fullword ascii - $s3 = "+HcD$DHcL$DH" fullword ascii - $s4 = "D$P9D$@}0" fullword ascii - $s5 = "tkHcD$8H" fullword ascii - $s6 = "BHcD$D" fullword ascii - $s7 = "|$(2t%" fullword ascii - $s8 = "D$ 9D$(}z" fullword ascii - $s9 = "D$ 9D$$}w" fullword ascii - $s10 = "|$02t\"" fullword ascii - $s11 = "L$P9H$s" fullword ascii - $s12 = "L$P9H$|uH" fullword ascii - $s13 = "D$89D$(}," fullword ascii - $s14 = " `l;Vig" fullword ascii - $s15 = "D$@HcL$\\H" fullword ascii - $s16 = "L$p9A