import "hash"

rule AM0NEye_FindModule {
	meta:
		description = "AM0NEye - FindModule.o"
		sha256 = "6382401da4b33f85be0491f73d26080748821f25ce457dfee4c55c43308867c4"
	strings:
		$s1 = "ExecuteSimpleSystemCallBase_Epilogue" ascii fullword
		$s2 = "EnumerateProcessModules" ascii fullword
		$s3 = "ExecuteSimpleSystemCallBase_Check_6_X_XXXX" ascii fullword
		$s4 = "ExecuteSimpleSystemCallBase_Finished" ascii fullword
		$s5 = "ExecuteSimpleSystemCallBase_SystemCall_6_3_XXXX" ascii fullword
		$s6 = "ExecuteSimpleSystemCallBase_SystemCall_6_2_XXXX" ascii fullword
		$s7 = "ExecuteSimpleSystemCallBase_SystemCall_10_0_XXXX" ascii fullword
		$s8 = "ExecuteSimpleSystemCallBase_Check_6_1_XXXX" ascii fullword
		$s9 = "ExecuteSimpleSystemCallBase_Check_X_X_XXXX" ascii fullword
		$s10 = "ExecuteSimpleSystemCallBase_SystemCall_6_1_7601" ascii fullword
		$s11 = "ExecuteSimpleSystemCallBase_SystemCall_Unknown" ascii fullword
		$s12 = "ExecuteSimpleSystemCallBase" ascii fullword
		$s13 = "IsElevated" ascii fullword
		$s14 = "__imp_ADVAPI32$LookupPrivilegeValueW" ascii fullword
		$s15 = "    ProcessID:   %lu" ascii fullword
		$s16 = "    ProcessName: %wZ" ascii fullword
		$s17 = "GetCurrentPid" ascii fullword
		$s18 = "SeDebugPrivilege" wide fullword
		$s19 = "FindModule.c" ascii fullword
		$s20 = "__imp_MSVCRT$_wcsicmp" ascii fullword
	condition:
		hash.sha256(0, filesize) == "6382401da4b33f85be0491f73d26080748821f25ce457dfee4c55c43308867c4" or uint16(0) == 0x8664 and filesize < 20KB and 8 of them
}

import "hash"

rule AM0NEye_GetDomainInfo {
	meta:
		description = "AM0NEye - GetDomainInfo.o"
		sha256 = "039586f2d56ef93343980bf7734c350f6898acc457c1bae184391439c1820d86"
	strings:
		$s1 = "__imp_NETAPI32$DsGetDcNameA" ascii fullword
		$s2 = "Domain Controller Address: %s" ascii fullword
		$s3 = "Domain Controller: %s" ascii fullword
		$s4 = "Domain Forest Name: %s" ascii fullword
		$s5 = "__imp_NETAPI32$NetApiBufferFree" ascii fullword
		$s6 = "DC Site Name: %s" ascii fullword
		$s7 = "GCC: (GNU) 10-win32 20220324" ascii fullword
		$s8 = "P@.xdata" ascii fullword
	condition:
		hash.sha256(0, filesize) == "039586f2d56ef93343980bf7734c350f6898acc457c1bae184391439c1820d86" or uint16(0) == 0x8664 and filesize < 2KB and all of them
}

import "hash"

rule AM0NEye_cThreadHijack {
	meta:
		description = "AM0NEye - cThreadHijack.o"
		sha256 = "d6fd0dd6a3a4bde08a2354e9298c1dacc6495c2173100b489e3c1d4526817a40"
	strings:
		$x1 = "[+] Wrote Beacon shellcode to the remote process!" ascii fullword
		$x2 = "[+] Target process PID: %d" ascii fullword
		$s3 = "[+] Successfully pointed the target thread's RIP register to the shellcode!" ascii fullword
		$s4 = "[+] Found a thread in the target process! Thread ID: %d" ascii fullword
		$s5 = "[+] Size of shellcode: %d bytes" ascii fullword
		$s6 = "C:\\Users\\ANON\\Desktop\\cThreadHijack\\cThreadHijack.o" ascii fullword
		$s7 = "__imp_KERNEL32$OpenProcess" ascii fullword
		$s8 = "__imp_KERNEL32$WriteProcessMemory" ascii fullword
		$s9 = "Error! Unable to set the target thread's RIP register. Error: 0x%lx" ascii fullword
		$s10 = "Error! Unable to write shellcode to allocated buffer. Error: 0x%lx" ascii fullword
		$s11 = "Error! Unable to get the state of the target thread. Error: 0x%lx" ascii fullword
		$s12 = "Error! Unable to open a handle to the process. Error: 0x%lx" ascii fullword
		$s13 = "__imp_KERNEL32$GetLastError" ascii fullword
		$s14 = "[+] Resuming the thread! Please wait for the Beacon payload to execute. This could take some time..." ascii fullword
		$s15 = "__imp_KERNEL32$GetThreadContext" ascii fullword
		$s16 = "[+] Suspending the targeted thread..." ascii fullword
		$s17 = "[+] Virtual memory for CreateThread and NtContinue routines allocated at 0x%llx inside of the remote process!" ascii fullword
		$s18 = "Error! Unable to allocate memory in the remote process. Error: 0x%lx" ascii fullword
		$s19 = "Error! Unable to allocate memory within the remote process. Error: 0x%lx" ascii fullword
		$s20 = "__imp_KERNEL32$GetModuleHandleA" ascii fullword
	condition:
		hash.sha256(0, filesize) == "d6fd0dd6a3a4bde08a2354e9298c1dacc6495c2173100b489e3c1d4526817a40" or uint16(0) == 0x8664 and filesize < 20KB and 1 of ($x*) and 4 of them
}

import "hash"

rule AM0NEye_CurlX64 {
	meta:
		description = "AM0NEye - curl.x64.o"
		sha256 = "a72a9b039ddd668ce86022621c6d073048b0d4ab38beb0d9bc98287e5a14c206"
	strings:
		$s1 = "User Agent: %s" ascii fullword
		$s2 = "__imp_KERNEL32$lstrlenA" ascii fullword
		$s3 = "__imp_WININET$HttpSendRequestA" ascii fullword
		$s4 = "__imp_WININET$InternetReadFile" ascii fullword
		$s5 = "sendHttpRequest" ascii fullword
		$s6 = "Retrieving HTTP Request info failed" ascii fullword
		$s7 = "__imp_WININET$HttpOpenRequestA" ascii fullword
		$s8 = "__imp_WININET$HttpQueryInfoA" ascii fullword
		$s9 = "%s %s:%i %s" ascii fullword
		$s10 = "Response Code: %s" ascii fullword
		$s11 = "__imp_BeaconDataInt" ascii fullword
		$s12 = "__imp_WININET$InternetConnectA" ascii fullword
		$s13 = "__imp_MSVCRT$strtok" ascii fullword
		$s14 = "__imp_MSVCRT$strcmp" ascii fullword
		$s15 = "entry.c" ascii fullword
		$s16 = "No response." ascii fullword
		$s17 = "__imp_WININET$InternetCloseHandle" ascii fullword
		$s18 = "__imp_WININET$InternetOpenA" ascii fullword
		$s19 = "P@.xdata" ascii fullword
		$s20 = "GCC: (GNU) 10-win32 20200525" ascii fullword
	condition:
		hash.sha256(0, filesize) == "a72a9b039ddd668ce86022621c6d073048b0d4ab38beb0d9bc98287e5a14c206" or uint16(0) == 0x8664 and filesize < 10KB and 8 of them
}

import "hash"

rule AM0NEye_ProcessHollowingX64 {
	meta:
		description = "AM0NEye - process-hollowing.x64.o"
		sha256 = "a453b3510ef0aa993b88f49d2a6f7a85bfab407033afb23340287b94eddff86d"
	strings:
		$x1 = "[+] Success - Your thread was resumed and your shellcode is being executed within the remote process!" ascii fullword
		$x2 = "[+] Success - Spawned process for %s at %d (PID)" ascii fullword
		$x3 = "[!] Failure - Could not queue APC for main thread of %d (PID) to shellcode address 0x%p" ascii fullword
		$x4 = "[+] Success - APC queued for main thread of %d (PID) to shellcode address 0x%p" ascii fullword
		$x5 = "[!] Failure - Could not create a process for %s using CreateProcessA()" ascii fullword
		$s6 = "[+] Success - Wrote %d bytes to memory in remote process %d (PID) at 0x%p" ascii fullword
		$s7 = "[!] Failure - Could not allocate memory to remote process %d (PID)" ascii fullword
		$s8 = "[+] Success - Allocated RE memory in remote process %d (PID) at: 0x%p" ascii fullword
		$s9 = "[!] Failure - Could not write payload to memory at 0x%p" ascii fullword
		$s10 = "__imp_KERNEL32$WriteProcessMemory" ascii fullword
		$s11 = "[!] Failure - Could not resume thread." ascii fullword
		$s12 = "__imp_KERNEL32$CreateProcessA" ascii fullword
		$s13 = "__imp_KERNEL32$ResumeThread" ascii fullword
		$s14 = "__imp_KERNEL32$QueueUserAPC" ascii fullword
		$s15 = "__imp_KERNEL32$VirtualAllocEx" ascii fullword
		$s16 = "__imp_MSVCRT$memset" ascii fullword
		$s17 = "__imp_BeaconDataLength" ascii fullword
		$s18 = "hollow.x64.c" ascii fullword
		$s19 = "P@.xdata" ascii fullword
		$s20 = "GCC: (GNU) 12 20220819" ascii fullword
	condition:
		hash.sha256(0, filesize) == "a453b3510ef0aa993b88f49d2a6f7a85bfab407033afb23340287b94eddff86d" or uint16(0) == 0x8664 and filesize < 10KB and 1 of ($x*) and 4 of them
}

import "hash"

rule AM0NEye_SyscallsdumpX64 {
	meta:
		description = "AM0NEye - syscallsdump.x64.o"
		sha256 = "b33dc013e2168ebb37d8ac80dbcd778c6bda2ede4927b47ec95f32c87ad125fd"
	strings:
		$s1 = "Dumping PID %d to file: %s" ascii fullword
		$s2 = "Failed to retrieve PID %d process handle." ascii fullword
		$s3 = "Failed to create dump file at %s" ascii fullword
		$s4 = "Failed to set debug privilege." ascii fullword
		$s5 = "Failed to create minidump." ascii fullword
		$s6 = "Unhooking - Initial ZwProtectVirtualMemory failed." ascii fullword
		$s7 = "Unhooking - ZwWriteVirtualMemory failed." ascii fullword
		$s8 = "Unhooking - Final ZwProtectVirtualMemory failed." ascii fullword
		$s9 = "__imp_DBGHELP$MiniDumpWriteDump" ascii fullword
		$s10 = "__imp_ADVAPI32$LookupPrivilegeValueW" ascii fullword
		$s11 = "Failed to unhook NtReadVirtualMemory." ascii fullword
		$s12 = "  [!] OS Version not supported." ascii fullword
		$s13 = "SW2_GetSyscallNumber" ascii fullword
		$s14 = "SeDebugPrivilege" wide fullword
		$s15 = "__imp_BeaconDataInt" ascii fullword
		$s16 = "entry.c" ascii fullword
		$s17 = "__imp_MSVCRT$_wcsicmp" ascii fullword
		$s18 = "__imp_MSVCRT$memset" ascii fullword
		$s19 = "UnhookFunction" ascii fullword
		$s20 = "__imp_MSVCRT$swprintf_s" ascii fullword
	condition:
		hash.sha256(0, filesize) == "b33dc013e2168ebb37d8ac80dbcd778c6bda2ede4927b47ec95f32c87ad125fd" or uint16(0) == 0x8664 and filesize < 30KB and 8 of them
}

import "hash"

rule AM0NEye_UnhookX86 {
	meta:
		description = "AM0NEye - unhook.x86.o"
		sha256 = "b67570680ffd7ebf5c8479e364c7a50ccf293170feb195172b9d907b5f171a88"
	strings:
		$s1 = "C:\\Users\\user\\Desktop\\unhook-bof\\unhook.x86.o" ascii fullword
		$s2 = "_GetProcessEnvironmentBlock" ascii fullword
		$s3 = "__imp__KERNEL32$GetModuleHandleW@4" ascii fullword
		$s4 = "__imp__KERNEL32$VirtualProtect@16" ascii fullword
		$s5 = "__imp__KERNEL32$CreateFileMappingW@24" ascii fullword
		$s6 = "_CustomGetModuleHandleW" ascii fullword
		$s7 = "__imp__KERNEL32$MapViewOfFile@20" ascii fullword
		$s8 = "_GetRedirectedName_V6" ascii fullword
		$s9 = "__imp__KERNEL32$CloseHandle@4" ascii fullword
		$s10 = "__imp__KERNEL32$UnmapViewOfFile@4" ascii fullword
		$s11 = "__imp__KERNEL32$LoadLibraryW@4" ascii fullword
		$s12 = "_GetRedirectedName" ascii fullword
		$s13 = "_GetInMemoryOrderModuleList" ascii fullword
		$s14 = "_IsBeaconDLL" ascii fullword
		$s15 = "__imp__KERNEL32$CreateFileW@28" ascii fullword
		$s16 = "__imp__KERNEL32$VirtualAlloc@16" ascii fullword
		$s17 = "_GetRedirectedName_V2" ascii fullword
		$s18 = "_GetRedirectedName_V4" ascii fullword
		$s19 = "__imp__KERNEL32$VirtualFree@12" ascii fullword
		$s20 = "_CustomGetProcAddressEx@12" ascii fullword
	condition:
		hash.sha256(0, filesize) == "b67570680ffd7ebf5c8479e364c7a50ccf293170feb195172b9d907b5f171a88" or uint16(0) == 0x014c and filesize < 20KB and 8 of them
}

import "hash"

rule AM0NEye_ZerologonX86 {
	meta:
		description = "AM0NEye - zerologon.x86.o"
		sha256 = "ddd797f2afb0f0cf3e85532d937e475f3af778b6032b979f3b739904b2c7bc07"
	strings:
		$s1 = "Z:\\devcenter\\zerologon\\dist\\zerologon.x86.o" ascii fullword
		$s2 = "%S is not vulnerable" ascii fullword
		$s3 = "Success! Use pth .\\%S 31d6cfe0d16ae931b73c59d7e0c089c0 and run dcscync" ascii fullword
		$s4 = "__imp__NETAPI32$I_NetServerPasswordSet2" ascii fullword
		$s5 = "Failed to set machine account pass for %S" ascii fullword
		$s6 = "P`   /DEFAULTLIB:\"uuid.lib\" /DEFAULTLIB:\"uuid.lib\" /DEFAULTLIB:\"LIBCMT\" /DEFAULTLIB:\"OLDNAMES\" " ascii fullword
		$s7 = "@comp.id}y" ascii fullword
		$s8 = "B.data" ascii fullword
		$s9 = "__imp__BeaconDataExtract" ascii fullword
		$s10 = "__imp__BeaconPrintf" ascii fullword
		$s11 = "__imp__BeaconDataParse" ascii fullword
		$s12 = "__imp__NETAPI32$I_NetServerReqChallenge" ascii fullword
		$s13 = "31d6cfe0d16ae931b73c59d7e0c089c0"
		$s14 = "__imp__NETAPI32$I_NetServerAuthenticate2" ascii fullword
		$s15 = "Microsoft (R) Optimizing Compiler" ascii fullword
		$s16 = "$SG87301" ascii fullword
		$s17 = "$SG87303H" ascii fullword
		$s18 = "$SG87304t" ascii fullword
	condition:
		hash.sha256(0, filesize) == "ddd797f2afb0f0cf3e85532d937e475f3af778b6032b979f3b739904b2c7bc07" or uint16(0) == 0x014c and filesize < 4KB and 8 of them
}

import "hash"

rule AM0NEye_SyscallsapcspawnX64 {
	meta:
		description = "AM0NEye - syscallsapcspawn.x64.o"
		sha256 = "defaacd4c05addae13998f3dce82e12e2f8f7c48af1e9061071f8157f01f7b61"
	strings:
		$s1 = "Shellcode injection completed successfully!" ascii fullword
		$s2 = "__imp_BeaconSpawnTemporaryProcess" ascii fullword
		$s3 = "Failed to spawn process." ascii fullword
		$s4 = "InjectShellcode" ascii fullword
		$s5 = "Failed to spawn process. Exiting..." ascii fullword
		$s6 = "NtResumeThread - FAILED! X" ascii fullword
		$s7 = "Spawned Process with PID: %d" ascii fullword
		$s8 = "NtQueueApcThread - FAILED! X" ascii fullword
		$s9 = "__imp_BeaconCleanupProcess" ascii fullword
		$s10 = "NtUnmapViewOfSection - FAILED! X" ascii fullword
		$s11 = "NtCreateSection - FAILED! X" ascii fullword
		$s12 = "NtMapViewOfSection2 - FAILED! X" ascii fullword
		$s13 = "NtMapViewOfSection - FAILED! X" ascii fullword
		$s14 = "SW2_GetSyscallNumber" ascii fullword
		$s15 = "entry.c" ascii fullword
		$s16 = "__imp_MSVCRT$memcpy" ascii fullword
		$s17 = "__imp_BeaconDataLength" ascii fullword
		$s18 = "SW2_HashSyscall" ascii fullword
		$s19 = "GCC: (GNU) 10-win32 20200525" ascii fullword
		$s20 = "0@.rdata" ascii fullword
	condition:
		hash.sha256(0, filesize) == "defaacd4c05addae13998f3dce82e12e2f8f7c48af1e9061071f8157f01f7b61" or uint16(0) == 0x8664 and filesize < 30KB and 8 of them
}

import "hash"
import "pe"

rule AtlasC2_ClientDll {
	meta:
		description = "AtlasC2 - Client.dll"
		sha256 = "86979aca65aef25f18132a2fc328f3d9234298e9d9c3b6cbd4a98a1ac7728c9d"
	strings:
		$x1 = "Executes a command in the context of cmd.exe" wide fullword
		$x2 = "Execute a PS command using the PS DLLs" wide fullword
		$s3 = "command to execute" wide fullword
		$s4 = "Client.dll" wide fullword
		$s5 = "[*] Usage: RmDir [targetDir]" wide fullword
		$s6 = "[*] Usage: RmFile [targetFile]" wide fullword
		$s7 = "Fetch user id of user running implant process" wide fullword
		$s8 = "<UtilExecute>b__0" ascii fullword
		$s9 = "UtilExecute" ascii fullword
		$s10 = "<UtilExecute>b__8_0" ascii fullword
		$s11 = "ExecuteAssemMethod" wide fullword
		$s12 = "ExecuteAssem" wide fullword
		$s13 = "[*] Usage: Getuid" wide fullword
		$s14 = "Execute a specifed assem type from its entry point" wide fullword
		$s15 = "Executes specified method belonging to a loaded assem type" wide fullword
		$s16 = "[-] Connection to teamserver could not be established or no implant currently set" wide fullword
		$s17 = "path to PowerShell file to load into implant process" wide fullword
		$s18 = "byte array to load into implant process" wide fullword
		$s19 = "System.ComponentModel.Primitives" ascii fullword
		$s20 = "System.Net.WebClient" ascii fullword
	condition:
		hash.sha256(0, filesize) == "86979aca65aef25f18132a2fc328f3d9234298e9d9c3b6cbd4a98a1ac7728c9d" or uint16(0) == 0x5a4d and filesize < 100KB and 1 of ($x*) and 4 of them
}

import "pe"
import "hash"

rule AtlasC2_Client {
	meta:
		description = "AtlasC2 - Client.exe"
		sha256 = "3fcc85c86db9e7f5e218d56af9f7ecabbf0284e447c3a70a14c89138d33d384b"
	strings:
		$s1 = "hostfxr.dll" wide fullword
		$s2 = "--- Invoked %s [version: %s, commit hash: %s] main = {" wide fullword
		$s3 = "This executable is not bound to a managed DLL to execute. The binding value is: '%s'" wide fullword
		$s4 = "D:\\a\\_work\\1\\s\\artifacts\\obj\\win-x64.Release\\corehost\\cli\\apphost\\standalone\\Release\\apphost.pdb" ascii fullword
		$s5 = "Client.dll" wide fullword
		$s6 = "  - %s&apphost_version=%s" wide fullword
		$s7 = "The managed DLL bound to this executable is: '%s'" wide fullword
		$s8 = "A fatal error was encountered. This executable was not bound to load a managed DLL." wide fullword
		$s9 = "Showing error dialog for application: '%s' - error code: 0x%x - url: '%s'" wide fullword
		$s10 = "Failed to resolve full path of the current executable [%s]" wide fullword
		$s11 = "https://go.microsoft.com/fwlink/?linkid=798306" wide fullword
		$s12 = "The managed DLL bound to this executable could not be retrieved from the executable image." wide fullword
		$s13 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s14 = "  - Installing .NET prerequisites might help resolve this problem." wide fullword
		$s15 = "  - https://aka.ms/dotnet-core-applaunch?" wide fullword
		$s16 = "Failed to load the dll from [%s], HRESULT: 0x%X" wide fullword
		$s17 = "The required library %s does not support relative app dll paths." wide fullword
		$s18 = "Failed to read environment variable [%s], HRESULT: 0x%X" wide fullword
		$s19 = "The application to execute does not exist: '%s'." wide fullword
		$s20 = "apphost" wide fullword
	condition:
		hash.sha256(0, filesize) == "3fcc85c86db9e7f5e218d56af9f7ecabbf0284e447c3a70a14c89138d33d384b" or pe.characteristics & pe.EXECUTABLE_IMAGE and uint16(0) == 0x5a4d and filesize < 400KB and 8 of them
}

import "math"
import "hash"

rule BruteRatel_BadgerBin_x64_RtlExitUserThread {
	meta:
		description = "BruteRatel - badger_x64_RtlExitUserThread.bin"
		sha256_1 = "6d7ba1938fb5de743f867cf3104df89a5e3afed80c0c5861c77e7befc073f3d8"
		sha256_2 = "1b13d5dab78b7b6c4d85ec5eb9e60854c37287384d7266d5c6583b8367f69583"
	strings:
		$s1 = "AYAXZYPAQH" ascii fullword
		$s2 = "AWAVAUATM" ascii fullword
		$s3 = "tpGb#_," ascii fullword
		$s4 = "OEvy[)q" ascii fullword
		$s5 = "pmiSTvdy" ascii fullword
		$s6 = "TaLcDw;lI" ascii fullword
		$s7 = "MrVeO[9" ascii fullword
		$s8 = "WUtEFwQX" ascii fullword
		$s9 = "9WVZeLFi" ascii fullword
		$s10 = "eIvV0h+" ascii fullword
		$s11 = "zllG!r*" ascii fullword
		$s12 = "mZnFr_." ascii fullword
		$s13 = "sLIv9`0T" ascii fullword
		$s14 = "$vufz?" ascii fullword
		$s15 = "Q5/*}@}ud%AXQRAPAQL" ascii fullword
		$s16 = "AWAVAUATWVH" ascii fullword
		$s17 = "oaNpx3" ascii fullword
		$s18 = "\\0X/pa" ascii fullword
		$s19 = "VfaFB0" ascii fullword
		$s20 = "\\x(BEI" ascii fullword
		$s21 = "ZgaoJ,9" ascii fullword
		$s22 = "IpKSfvlR" ascii fullword
		$s23 = "d%>d$/:iAXQRAPAQL" ascii fullword
		$s24 = "/Yesbu/6" ascii fullword
		$s25 = "teXrmE<" ascii fullword
	condition:
		hash.sha256(0, filesize) == "6d7ba1938fb5de743f867cf3104df89a5e3afed80c0c5861c77e7befc073f3d8" or hash.sha256(0, filesize) == "1b13d5dab78b7b6c4d85ec5eb9e60854c37287384d7266d5c6583b8367f69583" or math.entropy(0, filesize) >= 7 and uint16(0) == 0x8348 and filesize < 700KB and 6 of them
}

import "math"
import "hash"

rule BruteRatel_BadgerStealthBin_x64_RtlExitUserThread {
	meta:
		description = "BruteRatel - badger_x64_stealth_RtlExitUserThread.bin"
		sha256_1 = "c7d36f2d9b3d532e892013a3a74b1dfde6430da4c799bb0b0812e01ad557a13c"
		sha256_2 = "ab2ee8a4068329fe2731d82c7ffa31ea1262f67ea08afa58bcd3280b3fbf6324"
	strings:
		$s1 = "AYAXZYPAQH" ascii fullword
		$s2 = "AWAVAUATM" ascii fullword
		$s3 = "AWAVAUM" ascii fullword
		$s4 = "bhfSv!6" ascii fullword
		$s5 = "VrdJrcU" ascii fullword
		$s6 = "tXRC4DCWt" ascii fullword
		$s7 = "6rhfN^4qyW" ascii fullword
		$s8 = "kejA\"'" ascii fullword
		$s9 = "LgVSX[4>" ascii fullword
		$s10 = "CXaAb4D6" ascii fullword
		$s11 = "XjXxiQ?" ascii fullword
		$s12 = "MOpm~vr" ascii fullword
		$s13 = "mmq&e$ddAXQRAPAQL" ascii fullword
		$s14 = "Jiysu^[r" ascii fullword
		$s15 = "_(t.oGR" ascii fullword
		$s16 = "tKTU7!2" ascii fullword
		$s17 = "xUdcmD" ascii fullword
		$s18 = "|owVVk)DK" ascii fullword
		$s19 = "EtPevsx" ascii fullword
		$s20 = "samgQ\"" ascii fullword
		$s21 = ".sWP&|" ascii fullword
		$s22 = "\"(hvLZ\\wE" ascii fullword
		$s23 = ",.MMgQ)y<" ascii fullword
		$s24 = "+ l%(U^u" ascii fullword
		$s25 = "SxjTLZ2" ascii fullword
		$s26 = "OJQx>$-=" ascii fullword
		$s27 = "|JXPC}5Q" ascii fullword
	condition:
		hash.sha256(0, filesize) == "c7d36f2d9b3d532e892013a3a74b1dfde6430da4c799bb0b0812e01ad557a13c" or hash.sha256(0, filesize) == "ab2ee8a4068329fe2731d82c7ffa31ea1262f67ea08afa58bcd3280b3fbf6324" or math.entropy(0, filesize) >= 7 and uint16(0) == 0x8348 and filesize < 700KB and 8 of them
}

import "math"
import "hash"

rule BruteRatel_BadgerStealthBin_x64_WaitForSingleObject {
	meta:
		description = "BruteRatel - badger_x64_stealth_WaitForSingleObject.bin"
		sha256_1 = "efa977d502ce60fd5d596b64ff5bd07bb7fa71eb956bc8ca1e33dd23b68a4d8c"
		sha256_2 = "f5d0216c16287f0a84689ccfc732c6b4efcb686e2476b2dbd6aa5bb7802fd7df"
	strings:
		$s1 = "-},p:\\" ascii fullword
		$s2 = "AYAXZYPAQH" ascii fullword
		$s3 = "AWAVAUATM" ascii fullword
		$s4 = "AWAVAUM" ascii fullword
		$s5 = "\\o /No" ascii fullword
		$s6 = "mRCBh0e" ascii fullword
		$s7 = "iIHGF\\(" ascii fullword
		$s8 = "@$$)#|v}AXQRAPAQL" ascii fullword
		$s9 = "QaLb5+y" ascii fullword
		$s10 = "DsWN8F\\L" ascii fullword
		$s11 = "EscU,yQPaeB" ascii fullword
		$s12 = "|XRTiqS{" ascii fullword
		$s13 = "MXxG)]q" ascii fullword
		$s14 = "zesf!ub" ascii fullword
		$s15 = "_riizb_6" ascii fullword
		$s16 = "BABqh\\" ascii fullword
		$s17 = "xFMD@CH" ascii fullword
		$s18 = "eAtA_b-" ascii fullword
		$s19 = "R$.Naq" ascii fullword
		$s20 = "gQId?99<" ascii fullword
		$s21 = "N!^ /O" ascii fullword
		$s22 = "AqckaG(c" ascii fullword
		$s23 = "=ESzR=LH" ascii fullword
		$s24 = "50szmET|E" ascii fullword
		$s25 = "}- 0I$e" ascii fullword
	condition:
		hash.sha256(0, filesize) == "efa977d502ce60fd5d596b64ff5bd07bb7fa71eb956bc8ca1e33dd23b68a4d8c" or hash.sha256(0, filesize) == "f5d0216c16287f0a84689ccfc732c6b4efcb686e2476b2dbd6aa5bb7802fd7df" or math.entropy(0, filesize) >= 7 and uint16(0) == 0x8348 and filesize < 700KB and 8 of them
}

import "pe"
import "math"
import "hash"

rule BruteRatel_BadgerDll_x86 {
	meta:
		description = "BruteRatel - badger_x86.dll"
		sha256_1 = "434a0fa442b1322e654142fe6a8bc35df3bcdebacb030ba68c4644f96df5caac"
		sha256_2 = "a38370ca0d2421369f30c1bd83cc5a7d393ba86ee16ae277aab2008374e7b278"
	strings:
		$s1 = "F5M5INBS.dll" ascii fullword
		$s2 = "  VirtualQuery failed for %d bytes at address %p" ascii fullword
		$s3 = "%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p." ascii fullword
		$s4 = "4!535?5f5{5" ascii fullword
		$s5 = "  VirtualProtect failed with code 0x%x" ascii fullword
		$s6 = "cH:\"+SY" ascii fullword
		$s7 = "  Unknown pseudo relocation protocol version %d." ascii fullword
		$s8 = "TaNnOhb" ascii fullword
		$s9 = ")warvr6f" ascii fullword
		$s10 = "3;WiFF!S" ascii fullword
		$s11 = "VMbw`iC)" ascii fullword
		$s12 = "HvbS29@~\\A" ascii fullword
		$s13 = "WkCox*V%" ascii fullword
		$s14 = "WbkiPR%" ascii fullword
		$s15 = "ywTl=lQu" ascii fullword
		$s16 = "RCyDgt/" ascii fullword
		$s17 = "_SGimRpH" ascii fullword
		$s18 = "Gypy?#W" ascii fullword
		$s19 = "rKNW\\$D" ascii fullword
		$s20 = "QGTZx.\"" ascii fullword
		$s21 = "/ird_%k%vy?" ascii fullword
		$s22 = "zbMDO01" ascii fullword
		$s23 = "]Xbych4o" ascii fullword
		$s24 = "TNUu!E <" ascii fullword
		$s25 = "vSpZ3A3" ascii fullword
		$s26 = "stXi}G<" ascii fullword
		$s27 = "gkms\\#" ascii fullword
		$s28 = "V\\bhaV!" ascii fullword
		$s29 = "ZrJqHBf`" ascii fullword
	condition:
		hash.sha256(0, filesize) == "434a0fa442b1322e654142fe6a8bc35df3bcdebacb030ba68c4644f96df5caac" or hash.sha256(0, filesize) == "a38370ca0d2421369f30c1bd83cc5a7d393ba86ee16ae277aab2008374e7b278" or math.entropy(0, filesize) >= 7 and pe.imports("kernel32.dll", "GetNativeSystemInfo") and pe.imports("kernel32.dll", "VirtualProtect") and pe.characteristics & pe.DLL and uint16(0) == 0x5a4d and filesize < 700KB and 8 of them
}

import "pe"
import "math"
import "hash"

rule BruteRatel_BadgerService_x86 {
	meta:
		description = "BruteRatel - badger_x86_service.exe"
		sha256_1 = "ac99a80277cd93f35df6a962fb13fe807a28328433e5d1d8765a13e9bc9562cc"
		sha256_2 = "385c2e83b1f84acd9418c6cfaed52adc943d5b768ebe8dc731a73adf7edaa3a4"
	strings:
		$s1 = "Manages universal application core process that in Windows 8 and continues in Windows 10. It is used to determine whether univer"
		$s2 = "  VirtualQuery failed for %d bytes at address %p" ascii fullword
		$s3 = "%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p." ascii fullword
		$s4 = "Manages universal application core process that in Windows 8 and continues in Windows 10. It is used to determine whether univer"
		$s5 = "  VirtualProtect failed with code 0x%x" ascii fullword
		$s6 = "tion or microphone. It helps to transact records of your universal apps with the trust and privacy settings of user." ascii fullword
		$s7 = "TransactionBrokerService" ascii fullword
		$s8 = "  Unknown pseudo relocation protocol version %d." ascii fullword
		$s9 = "'tSAc?" ascii fullword
		$s10 = "adME<2B" ascii fullword
		$s11 = "EtWnPlR@*" ascii fullword
		$s12 = "xA]%d$" ascii fullword
		$s13 = "bTIlD:L" ascii fullword
		$s14 = "eldi.#]" ascii fullword
		$s15 = "wglk!@" ascii fullword
		$s16 = "WLiF*q:" ascii fullword
		$s17 = "YypyU`C" ascii fullword
		$s18 = ")lXxY| 2" ascii fullword
		$s19 = "ODVYo{# #" ascii fullword
		$s20 = "qWTLG$i" ascii fullword
		$s21 = "}%EP%VJ|D" ascii fullword
		$s22 = "wOCo*.|j\\" ascii fullword
	condition:
		hash.sha256(0, filesize) == "ac99a80277cd93f35df6a962fb13fe807a28328433e5d1d8765a13e9bc9562cc" or hash.sha256(0, filesize) == "385c2e83b1f84acd9418c6cfaed52adc943d5b768ebe8dc731a73adf7edaa3a4" or math.entropy(0, filesize) >= 7 and pe.imports("kernel32.dll", "GetNativeSystemInfo") and pe.imports("kernel32.dll", "VirtualProtect") and pe.imports("advapi32.dll", "ChangeServiceConfig2A") and pe.imports("advapi32.dll", "ChangeServiceConfigA") and pe.imports("advapi32.dll", "StartServiceCtrlDispatcherA") and pe.characteristics & pe.EXECUTABLE_IMAGE and uint16(0) == 0x5a4d and filesize < 700KB and 8 of them
}

import "hash"

rule BruteRatel_SyscallStageBin_x64_RtlExitUserThread {
	meta:
		description = "BruteRatel - syscall_stage_x64_RtlExitUserThread.bin"
		sha256 = "596a12d0c792569148bf5404d3074ba4fe0fff0f14f48f3244463d0d7a83f5ca"
	strings:
		$s1 = ":{\"auth\"L" ascii fullword
		$s2 = "AWAVAUATM" ascii fullword
		$s3 = "AWAVAUM" ascii fullword
		$s4 = "AWAVAUATI" ascii fullword
		$s5 = "{\"arch\":UH" ascii fullword
		$s6 = "AUATE1" ascii fullword
		$s7 = "PMch<H" ascii fullword
		$s8 = "McT$<L" ascii fullword
		$s9 = "64,\"cds\"H" ascii fullword
		$s10 = "n.\\d}#l$YH" ascii fullword
		$s11 = { 55 48 89 E5 41 57 41 56 41 55 41 54 4D 89 C4 57 }
		$s12 = { 55 48 89 E5 41 57 41 56 41 55 4D 89 C5 41 54 57 }
		$s13 = { 55 48 89 E5 57 56 53 48 89 CB 48 83 E4 F0 48 81 }
		$s14 = { 55 48 89 E5 41 57 41 56 41 55 41 54 49 89 D4 BA }
		$s15 = { 55 48 89 E5 41 55 41 54 57 56 53 48 83 E4 F0 48 }
	condition:
		hash.sha256(0, filesize) == "596a12d0c792569148bf5404d3074ba4fe0fff0f14f48f3244463d0d7a83f5ca" or uint16(0) == 0x8348 and filesize < 30KB and all of them
}

import "hash"

rule BruteRatel_SyscallStageBin_x86_RtlExitUserThread {
	meta:
		description = "BruteRatel - syscall_stage_x86_RtlExitUserThread.bin"
		sha256 = "2b1f466ab2c78bb3f8fd287a7cb3c87922317fe7cd348aa699e57b285544c2a9"
	strings:
		$s1 = "D$`POST" ascii fullword
		$s2 = "@h$p<pu" ascii fullword
		$s3 = "D$ich\":" ascii fullword
		$s4 = "D$yuth\"" ascii fullword
		$s5 = "D$m86,\"" ascii fullword
		$s6 = "D$e{\"ar" ascii fullword
		$s7 = "D$\\\"}}" ascii fullword
		$s8 = "D$u:{\"a" ascii fullword
		$s9 = "D$qcds\"" ascii fullword
		$s10 = "n.\\d}#l$YRQ" ascii fullword
		$s11 = { 55 8B 7C 24 58 03 3B 89 3C 24 E8 97 04 00 00 3B }
	condition:
		hash.sha256(0, filesize) == "2b1f466ab2c78bb3f8fd287a7cb3c87922317fe7cd348aa699e57b285544c2a9" or uint16(0) == 0xe483 and filesize < 20KB and all of them
}

import "hash"
import "pe"

rule C3 {
	meta:
		description = "C3 - NodeRelayDll_r64.dll, NodeRelayDll_r86.dll"
		sha256_1 = "ca83ab01d46925f1d3a559affd3398d1cfe5d0abd637413cd5ae25f1fe7bd008"
		sha256_2 = "85bc111b4d83b7fafd4c72832f23ebeadd1a9a74942aab072c928b1fc8b55625"
	strings:
		$s1 = "api-ms-win-core-synch-l1-2-0.dll" wide fullword
		$s2 = "AppPolicyGetProcessTerminationMethod" ascii fullword
		$s3 = "        <requestedExecutionLevel level='asInvoker' uiAccess='false' />" ascii fullword
		$s4 = "[x] error creating Token" ascii fullword
		$s5 = "[x] error setting token" ascii fullword
		$s6 = "AppPolicyGetThreadInitializationType" ascii fullword
		$s7 = "invalid vector subscript" ascii fullword
		$s8 = " Type Descriptor'" ascii fullword
		$s9 = ".?AVfilesystem_error@filesystem@std@@" ascii fullword
		$s10 = "[x] error duplicating token" ascii fullword
		$s11 = "directory_iterator::operator++" ascii fullword
		$s12 = "syntax error " ascii fullword
		$s13 = "operator co_await" ascii fullword
		$s14 = "object key" ascii fullword
		$s15 = "operator<=>" ascii fullword
		$s16 = ".data$rs" ascii fullword
		$s17 = "sysrandom" ascii fullword
		$s18 = "parse error: character [" ascii fullword
		$s19 = "X-Atlassian-Token" ascii fullword
		$s20 = ".?AVparse_error@detail@nlohmann@@" ascii fullword
	condition:
		hash.sha256(0, filesize) == "ca83ab01d46925f1d3a559affd3398d1cfe5d0abd637413cd5ae25f1fe7bd008" or hash.sha256(0, filesize) == "85bc111b4d83b7fafd4c72832f23ebeadd1a9a74942aab072c928b1fc8b55625" or pe.imports("kernel32.dll", "VirtualProtect") and pe.imports("kernel32.dll", "FindNextFileW") and pe.imports("advapi32.dll", "DuplicateTokenEx") and pe.imports("advapi32.dll", "SystemFunction036") and pe.imports("winhttp.dll", "WinHttpConnect") and pe.imports("winhttp.dll", "WinHttpCrackUrl") and pe.characteristics & pe.DLL and ((uint16(0) == 0x5a4d and filesize < 4000KB and (8 of them)) or (all of them))
}

import "hash"

rule Callidus_DLLs {
	meta:
		description = "Callidus - OneNoteC2Client.dll, OutlookC2Client.dll"
		sha256_1 = "066857279d1e93a2ffdb1df8e1d509f6cc58a60083674e842a1e178cf1483904"
		sha256_2 = "4f9e6582ebf1b3d5077d8a94b3696bc71f43984c7672c9eb696868f9dd711bca"
	strings:
		$s1 = "ShellExecuteWithPath" ascii fullword
		$s2 = "<ShellExecuteWithPath>b__1" ascii fullword
		$s3 = "<ShellExecuteWithPath>b__0" ascii fullword
		$s4 = "System.Diagnostics.Process" ascii fullword
		$s5 = "ShellCommand" ascii fullword
		$s6 = "https://graph.microsoft.com/.default" wide fullword
		$s7 = "CallGetWebApiAndProcessResultASync" ascii fullword
		$s8 = "<CallGetWebApiAndProcessResultASync>d__5" ascii fullword
		$s9 = "getuserid" ascii fullword
		$s10 = "<CallGetWebApiAndProcessResultASync>b__5_0" ascii fullword
		$s11 = "CallPostWebApiAndProcessResultASync" ascii fullword
		$s12 = "get_contentType" ascii fullword
		$s13 = "get_content" ascii fullword
		$s14 = "getmessages" ascii fullword
		$s15 = "System.Configuration.ConfigurationManager" ascii fullword
		$s16 = "GetAccountsAsync" ascii fullword
		$s17 = "get_HttpClient" ascii fullword
		$s18 = "CallDeleteWebApiAndProcessResultASync" ascii fullword
		$s19 = "<content>k__BackingField" ascii fullword
		$s20 = "set_UseShellExecute" ascii fullword
	condition:
		hash.sha256(0, filesize) == "066857279d1e93a2ffdb1df8e1d509f6cc58a60083674e842a1e178cf1483904" or hash.sha256(0, filesize) == "4f9e6582ebf1b3d5077d8a94b3696bc71f43984c7672c9eb696868f9dd711bca" or ((uint16(0) == 0x5a4d and filesize < 80KB and (8 of them)) or (all of them))
}

import "pe"
import "hash"

rule DBC2_Agent {
	meta:
		description = "DBC2 - dbc2_agent.exe"
		sha256 = "ba606da59063a837e704a49b065979ad4ea4b508c8600e520a8c69948332661b"
	strings:
		$x1 = "ERROR - COULD NOT EXECUTE COMMAND:" wide fullword
		$s2 = "ERROR - Could not send key strokes to the process, probably wrong keystrokes sequence" wide fullword
		$s3 = "ERROR - Could not find a process with name " wide fullword
		$s4 = "https://content.dropboxapi.com/2/files/download" wide fullword
		$s5 = "ERROR - COULD NOT EXECUTE: " wide fullword
		$s6 = "OK - KeyLogger started" wide fullword
		$s7 = "%USERPROFILE%\\AppData\\Local\\WindowsUserLogRotate" wide fullword
		$s8 = "dbc2_agent.exe" wide fullword
		$s9 = "https://content.dropboxapi.com/2/files/upload" wide fullword
		$s10 = "https://api.dropboxapi.com/2/files/get_metadata" wide fullword
		$s11 = "OK - PROCESS STARTED: " wide fullword
		$s12 = "OK - Key strokes sent to process " wide fullword
		$s13 = "OK - Clipboard logger started" wide fullword
		$s14 = "schtasks /create /TN 'WindowsUserLogRotate' /TR '" wide fullword
		$s15 = "https://api.dropboxapi.com/2/files/list_folder" wide fullword
		$s16 = "https://api.dropboxapi.com/2/files/move" wide fullword
		$s17 = "https://api.dropboxapi.com/2/files/delete" wide fullword
		$s18 = "clipboardlogger" wide fullword
		$s19 = "OK - FILE DOWNLOADED AT: " wide fullword
		$s20 = "shellProcess" ascii fullword
	condition:
		hash.sha256(0, filesize) == "ba606da59063a837e704a49b065979ad4ea4b508c8600e520a8c69948332661b" or pe.characteristics & pe.EXECUTABLE_IMAGE and uint16(0) == 0x5a4d and filesize < 70KB and 1 of ($x*) and 4 of them
}

import "hash"

rule DeimosC2_Unix {
	meta:
		description = "DeimosC2 - screengrab.elf, shadowdump.elf"
		sha256_1 = "cf654c92792fd8964025e9dd7dc2dc0181b15c4868134ec92ad4ac166dc99050"
		sha256_2 = "2e8341a042e4c26fa6cfe2606075a56aa47587b7ca934789da3cb486cca871b7"
	strings:
		$x1 = "fmt: unknown base; can't happenhttp2: connection error: %v: %vin literal null (expecting 'l')in literal null (expecting 'u')in l"
		$x2 = "bytes.Buffer: reader returned negative count from Readcertificate is not valid for requested server name: %wcryptobyte: Builder "
		$x3 = "59604644775390625: missing method ; SameSite=StrictCOMPRESSION_ERRORCirculateNotify {ConfigureNotify {DiacriticalAcute;Diacritic"
		$x4 = "strings.Builder.Grow: negative countsyntax error scanning complex numbertls: keys must have at least one keytls: server did not "
		$x5 = "adding nil Certificate to CertPoolbad scalar length: %d, expected an't evaluate field %s in type %scan't handle %s for arg of"
		$x6 = "runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangeslice bounds out of range [:%x] with"
		$x7 = "IDS_Trinary_OperatorInsufficient StorageLeftArrowRightArrow;MAX_HEADER_LIST_SIZEMeroitic_HieroglyphsNegativeMediumSpace;NotGreat"
		$x8 = "s.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrconv: internal error, rest "
		$x9 = "tls: client certificate contains an unsupported public key of type %Ttls: handshake message of length %d bytes exceeds maximum o"
		$x10 = "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnablestrict-trans"
		$x11 = "got CONTINUATION for stream %d; expected stream %dhttp: putIdleConn: CloseIdleConnections was calledhttp: suspiciously long trai"
		$x12 = "%s slice too big: %d elements of %d bytes34694469519536141888238489627838134765625MapIter.Next called on exhausted iteratorTime."
		$x13 = ", RecursionAvailable: .localhost.localdomain/etc/apache/mime.types/etc/ssl/ca-bundle.pem/lib/time/zoneinfo.zip/usr/local/share/c"
		$x14 = "runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: stat underflow: val runtime: sudog with non-nil cruntime: sum"
		$x15 = "173472347597680709441192448139190673828125867361737988403547205962240695953369140625MapIter.Value called on exhausted iteratorPR"
		$x16 = "gob: cannot encode nil pointer of type heapBitsSetTypeGCProg: small allocationhttp: putIdleConn: keep alives disabledinvalid ind"
		$x17 = "HumpEqual;IP addressKeep-AliveKeyPress {KharoshthiLeftArrow;LeftFloor;Leftarrow;LessTilde;ManichaeanMellintrf;Message-IdMinusPlu"
		$x18 = "checkdead: no m for timercontext deadline exceedederror decoding []byte: %sexpected string; found %sexplicit tag has no childhtt"
		$x19 = "template: no template %q associated with template %qtls: received a session ticket with invalid lifetimetls: server selected uns"
		$x20 = "file descriptor in bad statefindrunnable: netpoll with pgcstopm: negative nmspinninggeneral SOCKS server failuregob: cannot enco"
	condition:
		hash.sha256(0, filesize) == "cf654c92792fd8964025e9dd7dc2dc0181b15c4868134ec92ad4ac166dc99050" or hash.sha256(0, filesize) == "2e8341a042e4c26fa6cfe2606075a56aa47587b7ca934789da3cb486cca871b7" or uint16(0) == 0x457f and filesize < 23000KB and 1 of ($x*)
}

import "hash"
import "pe"

rule FlyingAFalseFlag_Exchanger {
	meta:
		description = "FlyingAFalseFlag - Exchanger_x64.exe, Exchanger_x86.exe"
		sha256_1 = "6a5605da5f7207b1b14b798e9428c2310633664eed53ce7bdb39a6847eff6609"
		sha256_2 = "c337983b7eefbea3cc02e4d011398292ccbd475ba932ced40603a4a9a3927032"
	strings:
		$s1 = "api-ms-win-core-synch-l1-2-0.dll" wide fullword
		$s2 = "<GetItem xmlns=\"http://schemas.microsoft.com/exchange/services/2006/messages\">" ascii fullword
		$s3 = "<DeleteItem DeleteType=\"HardDelete\" xmlns=\"http://schemas.microsoft.com/exchange/services/2006/messages\">" ascii fullword
		$s4 = "<soap:Envelope xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:t="
		$s5 = "://schemas.microsoft.com/exchange/services/2006/types\" xmlns:m=\"http://schemas.microsoft.com/exchange/services/2006/messages\""
		$s6 = "[+] Found vault creds: %s / " ascii fullword
		$s7 = "[!] Failed to execute tasking" ascii fullword
		$s8 = "        <requestedExecutionLevel level='asInvoker' uiAccess='false' />" ascii fullword
		$s9 = "[+] Auto-hide rule '%s' is ready" ascii fullword
		$s10 = "mail@<domain.com>" ascii fullword
		$s11 = "%localappdata%\\Microsoft\\Outlook\\" wide fullword
		$s12 = "<AutoDiscoverSMTPAddress>" ascii fullword
		$s13 = "<m:MailboxSmtpAddress>**MAILBOX**</m:MailboxSmtpAddress>" ascii fullword
		$s14 = "[+] Got tasking... executing." ascii fullword
		$s15 = "<soap:Envelope xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:t="
		$s16 = "[!] Failed to create rule '%s'" ascii fullword
		$s17 = "[!] Failed to beacon to '%s'" ascii fullword
		$s18 = "</m:GetInboxRules>" ascii fullword
		$s19 = "  </soap:Header>" ascii fullword
	condition:
		hash.sha256(0, filesize) == "6a5605da5f7207b1b14b798e9428c2310633664eed53ce7bdb39a6847eff6609" or hash.sha256(0, filesize) == "c337983b7eefbea3cc02e4d011398292ccbd475ba932ced40603a4a9a3927032" or pe.imports("kernel32.dll", "FindNextFileW") and pe.imports("kernel32.dll", "TerminateProcess") and pe.imports("wininet.dll", "InternetConnectA") and pe.imports("advapi32.dll", "LookupAccountSidA") and ((uint16(0) == 0x5a4d and filesize < 300KB and (8 of them)) or (all of them))
}

import "hash"

rule MikeC2_MikeDrop {
	meta:
		description = "MikeC2 - MikeDrop.exe"
		sha256 = "933241f02ef81bef5f6b51ce3e5b3dbf242c829f899f64d2f10b0bad668a6424"
	strings:
		$s1 = "http://kali.host/MikeC2.exe" wide fullword
		$s2 = "MikeDrop.exe" wide fullword
		$s3 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s4 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s5 = ".NETFramework,Version=v4.7.2" ascii fullword
		$s6 = ".NET Framework 4.7.2" ascii fullword
		$s7 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36" wide fullword
		$s8 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s9 = "UserName: {0}" wide fullword
		$s10 = "Domain UserName: {0}" wide fullword
		$s11 = "MikeC2.Program" wide fullword
		$s12 = "MikeDrop" wide fullword
		$s13 = "      <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">" ascii fullword
		$s14 = "DoMikeC2" ascii fullword
		$s15 = "user-agent" wide fullword
		$s16 = "Program" ascii fullword
		$s17 = "Console" ascii fullword
		$s18 = "  </trustInfo>" ascii fullword
		$s19 = "Invoke" ascii fullword
	condition:
		hash.sha256(0, filesize) == "933241f02ef81bef5f6b51ce3e5b3dbf242c829f899f64d2f10b0bad668a6424" or uint16(0) == 0x5a4d and filesize < 20KB and 8 of them
}

import "hash"

rule Nimbo_C2_UnixBin_agent {
	meta:
		description = "Nimbo-C2 - agent.so"
		sha256 = "9fb7870c7c1dc8d2dd61ba77e34efe580ad0151c9b59b201b17a45a211d8ff49"
	strings:
		$s1 = "agent_execution_path_linux__config_32" ascii fullword
		$s2 = "agent_execution_path_windows__config_30" ascii fullword
		$s3 = "AWAVAUA" ascii fullword
		$s4 = "sleep_on_execution__config_28" ascii fullword
		$s5 = "SIGSEGV: Illegal storage access. (Attempt to read from nil?)" ascii fullword
		$s6 = "SIGPIPE: Pipe closed." ascii fullword
		$s7 = "reportUnhandledError__system_2855" ascii fullword
		$s8 = "reportUnhandledErrorAux__system_2752" ascii fullword
		$s9 = "getBigChunk__system_4510" ascii fullword
		$s10 = "getBottom__system_3996" ascii fullword
		$s11 = "getActiveStack__system_5401" ascii fullword
		$s12 = "cellSetGet__system_4918" ascii fullword
		$s13 = "doOperation__system_5296" ascii fullword
		$s14 = "getHugeChunk__system_4525" ascii fullword
		$s15 = "intSetGet__system_4180" ascii fullword
		$s16 = "sweep__system_5710" ascii fullword
		$s17 = "NTIhttpheaders__FbZeO4trJhT2CCJ9aLxejqw_" ascii fullword
		$s18 = "getDiscriminant__system_3619" ascii fullword
		$s19 = "getFileHandle__systemZio_228" ascii fullword
		$s20 = "getOccupiedMem__system_1936" ascii fullword
	condition:
		hash.sha256(0, filesize) == "9fb7870c7c1dc8d2dd61ba77e34efe580ad0151c9b59b201b17a45a211d8ff49" or uint16(0) == 0x457f and filesize < 600KB and 8 of them
}

import "hash"

rule PetaqImplant {
	meta:
		description = "PetaqImplant - PetaqImplant.exe"
		sha256 = "8ed63f7ea1a79dbf2cc9a338feff1dd4491a9daac38d4c86f67d7211783ae272"
	strings:
		$x1 = "    exec cmd.exe /c dir" wide fullword
		$x2 = "    execthread cmd.exe /c dir" wide fullword
		$x3 = "    lateralmovement wmiexec domain=galaxy username=administrator password=Password3 host=10.0.0.1 command=\"powershell " wide fullword
		$x4 = "    lateralmovement wmiexec domain=DOMAIN username=USER password=PASSWORD host=REMOTEHOST command=\"COMMANDTORUN\"" wide fullword
		$s5 = "Invalid credentials error may occur if the logged on user has no access to remote server IPC$. Try this before linking 'net use " wide
		$s6 = "The process is running with the payload injected." wide fullword
		$s7 = "    exec-sharpassembly url http://127.0.0.1/test.exe" wide fullword
		$s8 = "    exec-shellcode url http://127.0.0.1/Shellcode.bin ARCH64 T1" wide fullword
		$s9 = "    exec-shellcode url http://127.0.0.1/Shellcode.bin ARCH32 T2" wide fullword
		$s10 = "Execute a command/binary:" wide fullword
		$s11 = "* link smb://192.168.1.1/NamedPipeName" wide fullword
		$s12 = "Setting the startup information for the process to inject." wide fullword
		$s13 = "    download c:\\windows\\temp\\1.txt" wide fullword
		$s14 = "Execute Shellcode:" wide fullword
		$s15 = "Pushing the payload to the process memory." wide fullword
		$s16 = "Compile & Execute .NET source code:" wide fullword
		$s17 = "PetaqImplant.exe" wide fullword
		$s18 = "* transmit SESSIONID COMMAND" wide fullword
		$s19 = "shellcode" ascii fullword
		$s20 = "ExecShellcodeBridge" ascii fullword
	condition:
		hash.sha256(0, filesize) == "8ed63f7ea1a79dbf2cc9a338feff1dd4491a9daac38d4c86f67d7211783ae272" or uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) and 4 of them
}

import "hash"
import "pe"

rule PoshC2_Csc {
	meta:
		description = "PoshC2 - csc.exe"
		sha256 = "df8474fe610372aff283b0429626e1663b27e7c651242fbc7687ca6fd2d45caa"
	strings:
		$s1 = "csc.exe" ascii fullword
		$s2 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s3 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s4 = "Microsoft.CodeAnalysis" ascii fullword
		$s5 = "lpThreadId" ascii fullword
		$s6 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s7 = "      <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">" ascii fullword
		$s8 = "lpAddress" ascii fullword
		$s9 = "Protection" ascii fullword
		$s10 = "Program" ascii fullword
		$s11 = "lpStartAddress" ascii fullword
		$s12 = "RefSafetyRulesAttribute" ascii fullword
		$s13 = "flNewProtect" ascii fullword
		$s14 = "lpflOldProtect" ascii fullword
		$s15 = "  </trustInfo>" ascii fullword
		$s16 = "EmbeddedAttribute" ascii fullword
		$s17 = "dwStackSize" ascii fullword
		$s18 = "#REPLACEME64#" wide fullword
		$s19 = "#REPLACEME32#" wide fullword
		$s20 = "System.Runtime.CompilerServices" ascii fullword
		$s21 = "FromBase64String" ascii fullword
	condition:
		hash.sha256(0, filesize) == "df8474fe610372aff283b0429626e1663b27e7c651242fbc7687ca6fd2d45caa" or uint16(0) == 0x5a4d and filesize < 20KB and 8 of them
}

import "hash"

rule PoshC2_Fcomm {
	meta:
		description = "PoshC2 - fcomm.exe"
		sha256 = "f770e4b68e8d911e51a4de4cd84b36f290b7fcabe866063e26cee47afd98ba6c"
	strings:
		$s1 = "fcomm.exe" ascii fullword
		$s2 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s3 = "ParseCommandLineArgs" ascii fullword
		$s4 = "run-dll-background" wide fullword
		$s5 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s6 = "HostInfo" ascii fullword
		$s7 = "GetCurrentTasking" ascii fullword
		$s8 = "objContents" ascii fullword
		$s9 = "get_Actioned" ascii fullword
		$s10 = "CreateEncryptionAlgorithm" ascii fullword
		$s11 = "run-dll" wide fullword
		$s12 = "run-exe Core.Program Core " wide fullword
		$s13 = "initialised" ascii fullword
		$s14 = "loadmodule" wide fullword
		$s15 = "[!] This is not implemented yet in FComm implant types." wide fullword
		$s16 = "Microsoft.CodeAnalysis" ascii fullword
		$s17 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s18 = "SafeFileRead" ascii fullword
		$s19 = "FCommConnect" ascii fullword
		$s20 = "GzipCompress" ascii fullword
	condition:
		hash.sha256(0, filesize) == "f770e4b68e8d911e51a4de4cd84b36f290b7fcabe866063e26cee47afd98ba6c" or uint16(0) == 0x5a4d and filesize < 40KB and 8 of them
}

import "hash"

rule PoshC2_Sharp_Powershell_Runner {
	meta:
		description = "PoshC2 Sharp_Powershell_Runner.exe"
		sha256 = "a7fbb82f2606e3ec217d94fe83d4127e3a5a47290141875ff150243024fb2259"
	strings:
		$s1 = "Sharp_Powershell_Runner.exe" ascii fullword
		$s2 = "basepayload" ascii fullword
		$s3 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s4 = "get_SessionStateProxy" ascii fullword
		$s5 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s6 = "get_PSVariable" ascii fullword
		$s7 = "Sharp_Powershell_Runner" ascii fullword
		$s8 = "InvokeAutomation" ascii fullword
		$s9 = "Microsoft.CodeAnalysis" ascii fullword
		$s10 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s11 = "DllBaseAddress" ascii fullword
		$s12 = "RunspaceInvoke" ascii fullword
		$s13 = "      <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">" ascii fullword
		$s14 = "$o = IEX $c | Out-String" wide fullword
		$s15 = "Program" ascii fullword
		$s16 = "Encoding" ascii fullword
		$s17 = "RefSafetyRulesAttribute" ascii fullword
		$s18 = "  </trustInfo>" ascii fullword
		$s19 = "EmbeddedAttribute" ascii fullword
		$s20 = "baseAddr" ascii fullword
	condition:
		hash.sha256(0, filesize) == "a7fbb82f2606e3ec217d94fe83d4127e3a5a47290141875ff150243024fb2259" or uint16(0) == 0x5a4d and filesize < 20KB and 8 of them
}

import "hash"

rule PoshC2_DotNet2JS {
	meta:
		description = "PoshC2 - DotNet2JS.js"
		sha256 = "1193794ebfc3f9ae58e6bb443ecd783274285396c8b23533683e10da0c9d5c53"
	strings:
		$s1 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s2 = "AAAAAAAAAAAAAAAAAAAAAAAAA"
		$s3 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s4 = "AAAAAAAAAAAAAEAAAE"
		$s5 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s6 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAB"
		$s7 = "AAAAAAAAAAAAAAAAAAAAAAAAB"
		$s8 = "AAAAAAAAAAD"
		$s9 = "AAAAAAAAAEA"
		$s10 = "AAAAAAAAAAAAAAAAAAAAAAAAAAABD"
		$s11 = "AADAAAABAAAA"
		$s12 = "AAAAAAAAAAAAAAAAAAAAAcC0AAAAAAAB"
		$s13 = "ADAAAAA4AA"
		$s14 = "AAAAAAAAAAAAAE4A"
		$s15 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAA"
		$s16 = "AABAACAAAEAA"
		$s17 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAA"
		$s18 = "function dbg(s) {WScript.Echo(s);}" ascii fullword
		$s19 = "var ba = enc.GetBytes_4(b);" ascii fullword
		$s20 = "var length = enc.GetByteCount_2(b);" ascii fullword
	condition:
		hash.sha256(0, filesize) == "1193794ebfc3f9ae58e6bb443ecd783274285396c8b23533683e10da0c9d5c53" or uint16(0) == 0x6176 and filesize < 30KB and 8 of them
}

import "hash"

rule PoshC2_DropperPs1 {
	meta:
		description = "PoshC2 - dropper.ps1"
		sha256 = "a7f763a818db6da6433b4ffcafbbbd680597fee28bb97760ddd384caf0c25992"
	strings:
		$s1 = "$primern = (Get-Webclient -Cookie $pp).downloadstring($script:s)" ascii fullword
		$s2 = "if ($h -and (($psversiontable.CLRVersion.Major -gt 2))) {$wc.Headers.Add(\"Host\",$h)}" ascii fullword
		$s3 = "$procname = (Get-Process -id $pid).ProcessName" ascii fullword
		$s4 = "$o=\"$env:userdomain;$u;$env:computername;$env:PROCESSOR_ARCHITECTURE;$pid;$procname;#REPLACEURLID#\"" ascii fullword
		$s5 = "} if ($cookie) { $wc.Headers.Add([System.Net.HttpRequestHeader]::Cookie, \"SessionID=$Cookie\") }" ascii fullword
		$s6 = "$getcreds = new-object system.management.automation.PSCredential $username,$PSS;" ascii fullword
		$s7 = "$wc.Headers.Add(\"User-Agent\",\"#REPLACEUSERAGENT#\")" ascii fullword
		$s8 = "$PSS = ConvertTo-SecureString $password -AsPlainText -Force;" ascii fullword
		$s9 = "$wp.Credentials = $getcreds;" ascii fullword
		$s10 = "{$a.Key = [System.Convert]::FromBase64String($key)}" ascii fullword
		$s11 = "if ($username -and $password) {" ascii fullword
		$s12 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.Text.Encoding]::UTF8.GetString($u).Trim([char]"
		$s13 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.Text.Encoding]::UTF8.GetString($u).Trim([char]"
		$s14 = "$d = (Get-Date -Format \"yyyy-MM-dd\");" ascii fullword
		$s15 = "if ($key.getType().Name -eq \"String\")" ascii fullword
		$s16 = "$password = \"#REPLACEPROXYPASS#\"" ascii fullword
		$s17 = "#REPLACEPROXYCOMMAND#" ascii fullword
		$s18 = "$wc = New-Object System.Net.WebClient;" ascii fullword
		$s19 = "$e = $a.CreateEncryptor()" ascii fullword
		$s20 = "elseif($h){$script:s=\"https://$($h)#REPLACECONNECT#\";$script:sc=\"https://$($h)\"}" ascii fullword
	condition:
		hash.sha256(0, filesize) == "a7f763a818db6da6433b4ffcafbbbd680597fee28bb97760ddd384caf0c25992" or uint16(0) == 0x5223 and filesize < 10KB and 8 of them
}

import "hash"

rule PoshC2_ImplantCorePy {
	meta:
		description = "PoshC2 - Implant-Core.py"
		sha256 = "8653f19782f1e19e86caf6fdadc17790eb9d68ff34c8a249e9e9e26ba8000c88"
	strings:
		$x1 = "  # keylogger imported from https://raw.githubusercontent.com/EmpireProject/Empire/fcd1a3d32b4c37a392c59ffe241b9cb973fde7f4/lib/"
		$x2 = "  # keylogger imported from https://raw.githubusercontent.com/EmpireProject/Empire/fcd1a3d32b4c37a392c59ffe241b9cb973fde7f4/lib/"
		$s3 = "  s.call(\"crontab -l | { cat; echo '* 10 * * * sh %%s'; } | crontab -\" %% filename, shell=True)" ascii fullword
		$s4 = "  modpayload = modb64logger.replace(\"REPLACEME\",filename)" ascii fullword
		$s5 = "  returnval = \"%%s \\\\r\\\\nKeylogger started here: %%s\" %% (pids, filename)" ascii fullword
		$s6 = "  filename = \"%%s/%%s_psh.sh\" %% (dircontent, uuid.uuid4().hex)" ascii fullword
		$s7 = "  dircontent = \"%%s/.%%s\" %% (os.environ['HOME'], uuid.uuid4().hex)" ascii fullword
		$s8 = "            if hh[0]: req=urllib2.Request(server,dataimagebytes,headers={'Host':str(hh[0]),'User-agent':str(ua),'Cookie':\"Sessi"
		$s9 = "  returnval = \"Ran Start Another Implant - File dropped: %%s\" %% filename" ascii fullword
		$s10 = "                returnval = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)" ascii fullword
		$s11 = "  aes = get_encryption(key, iv)" ascii fullword
		$s12 = "      if hh[0]: req=urllib2.Request(server,headers={'Host':str(hh[0]),'User-agent':str(ua)})" ascii fullword
		$s13 = "  import subprocess as s" ascii fullword
		$s14 = "modules/python/collection/osx/keylogger.py" ascii fullword
		$s15 = "            if hh[0]: req=urllib2.Request(server,dataimagebytes,headers={'Host':str(hh[0]),'User-agent':str(ua),'Cookie':\"Sessi"
		$s16 = "            postcookie = encrypt(key, taskId).decode(\"utf-8\")" ascii fullword
		$s17 = "  import subprocess" ascii fullword
		$s18 = "  exec(modpayload)" ascii fullword
		$s19 = "  s.call(\"crontab -l | { cat;  } | grep -v '_psh.sh'| crontab -\", shell=True)" ascii fullword
		$s20 = "  modb64logger = base64.b64decode(b64logger)" ascii fullword
	condition:
		hash.sha256(0, filesize) == "8653f19782f1e19e86caf6fdadc17790eb9d68ff34c8a249e9e9e26ba8000c88" or uint16(0) == 0x6d69 and filesize < 40KB and 1 of ($x*) and 4 of them
}

import "hash"

rule PoshC2_ImplantCorePs1 {
	meta:
		description = "PoshC2 - Implant-Core.ps1"
		sha256 = "6d520463f8563d6a296d22b6824c690c9b6de8121c9b6f08307947874667c5f2"
	strings:
		$x1 = "$payloadraw = \"powershell -exec bypass -Noninteractive -windowstyle hidden -e $($EncodedPayloadScript)\"" ascii fullword
		$s2 = "$EncodedPayloadScript = [Convert]::ToBase64String($UnicodeEncoder.GetBytes($NewScript))" ascii fullword
		$s3 = "$NewScript = \"sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64Stri"
		$s4 = "$ScriptBytes = ([Text.Encoding]::ASCII).GetBytes($payloadclear)" ascii fullword
		$s5 = "g(`\"$EncodedCompressedScript`\"),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()\"" ascii fullword
		$s6 = "    $unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16)" ascii fullword
		$s7 = "    $unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16);" ascii fullword
		$s8 = "$EncodedCompressedScript = [Convert]::ToBase64String($CompressedScriptBytes)" ascii fullword
		$s9 = "$payload = $payloadraw -replace \"`n\", \"\"" ascii fullword
		$s10 = "$NewScript = \"sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64Stri"
		$s11 = "    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.Text.Encoding]::UTF8.GetString($unencrypte"
		$s12 = "    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.Text.Encoding]::UTF8.GetString($unencrypte"
		$s13 = "                      $splitcmd = $ReadCommandClear -replace \"multicmd\",\"\"" ascii fullword
		$s14 = "    $output = (New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$unencrypte"
		$s15 = "                                  if ($ReadCommandClear -match (\"(.+)Base64\")) { $result = $Matches[0] } # $result doesn't app"
		$s16 = "    $output = (New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$unencrypte"
		$s17 = "                                  if ($ReadCommandClear -match (\"(.+)Base64\")) { $result = $Matches[0] } # $result doesn't app"
		$s18 = "function Decrypt-String($key, $encryptedStringWithIV) {" ascii fullword
		$s19 = "dData)), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd()" ascii fullword
		$s20 = "          if (($ReadCommandClear) -and ($ReadCommandClear -ne \"fvdsghfdsyyh\")) {" ascii fullword
	condition:
		hash.sha256(0, filesize) == "6d520463f8563d6a296d22b6824c690c9b6de8121c9b6f08307947874667c5f2" or uint16(0) == 0x6b24 and filesize < 40KB and 1 of ($x*) and 4 of them
}

import "hash"

rule PoshC2_Shellcode {
	meta:
		description = "PoshC2 - Sharp_v2_x64_dll.b64, Sharp_v2_x64_Shellcode.b64, Sharp_v2_x86_dll.b64, Sharp_v2_x86_Shellcode.b64, Sharp_v4_x64_dll.b64, Sharp_v4_x64_Shellcode.b64, Sharp_v4_x86_dll.b64, Sharp_v4_x86_Shellcode.b64"
		sha256_1 = "dd654eb75c1f3736d4b5282e7338a5efcbd7481fc7b46ec38a3ff0ea573c408e"
		sha256_2 = "cb96cca9101899754efc33859353e0834496a98ee4381b1a9158c7403e1562d2"
		sha256_3 = "03c10e261a138666a1c5cf9cb577e8d73e041b1dae0a3d1198d116e4c2b5dec3"
		sha256_4 = "04ced8976f86801a23ee5fa1fb33f7cab5638039fb6d2a441a169784ce37adf9"
		sha256_5 = "ce950ee11e27e0a95840fa12c878af19910aa82d1ccd5eb99ab99c4131571989"
		sha256_6 = "fc454c2453d9cf6b64c0e6ffab76e6f26c584698a454c7cf2e07d96b11a29fb6"
		sha256_7 = "ddc5047d6a8bb245644c5385ead8fa0d3b751f2aabf9e88e423e0b9862e65019"
		sha256_8 = "f83bbf7318f982ddb457863cf2b45e13c402c2eff5bb1a4d5b8f074295ff46f9"
	strings:
		$s1 = "QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB"
		$s2 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s3 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s4 = "ACAAAAAAAAA"
		$s5 = "ABAAAAAAAAA"
		$s6 = "AAAADAAAAA"
		$s7 = "EAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
		$s8 = "AAAABAAAAA"
		$s9 = "AbAAAAAAAc"
		$s10 = "AAAACAAAAA"
		$s11 = "AAAAAAAAAAAAAAAAAAA"
	condition:
		hash.sha256(0, filesize) == "dd654eb75c1f3736d4b5282e7338a5efcbd7481fc7b46ec38a3ff0ea573c408e" or hash.sha256(0, filesize) == "cb96cca9101899754efc33859353e0834496a98ee4381b1a9158c7403e1562d2" or hash.sha256(0, filesize) == "03c10e261a138666a1c5cf9cb577e8d73e041b1dae0a3d1198d116e4c2b5dec3" or hash.sha256(0, filesize) == "04ced8976f86801a23ee5fa1fb33f7cab5638039fb6d2a441a169784ce37adf9" or hash.sha256(0, filesize) == "ce950ee11e27e0a95840fa12c878af19910aa82d1ccd5eb99ab99c4131571989" or hash.sha256(0, filesize) == "fc454c2453d9cf6b64c0e6ffab76e6f26c584698a454c7cf2e07d96b11a29fb6" or hash.sha256(0, filesize) == "ddc5047d6a8bb245644c5385ead8fa0d3b751f2aabf9e88e423e0b9862e65019" or hash.sha256(0, filesize) == "f83bbf7318f982ddb457863cf2b45e13c402c2eff5bb1a4d5b8f074295ff46f9" or (((uint16(0) == 0x5654 or uint16(0) == 0x4136) and filesize < 600KB and (8 of them)) or (all of them))
}

import "hash"

rule RedditC2_ImplaintWin {
	meta:
		description = "RedditC2 - RedditAgent.exe"
		sha256 = "8b534d0f9f699d6a02aca559f2699d914b0b3f8749e0d206bece0fe09b92ccc6"
	strings:
		$s1 = "RedditAgent.exe" wide fullword
		$s2 = "set_UseShellExecute" ascii fullword
		$s3 = "[+] Created agent session: " wide fullword
		$s4 = "run hostname" wide fullword
		$s5 = "powershell" wide fullword
		$s6 = "myPassword" wide fullword
		$s7 = "myxorkey" wide fullword
		$s8 = ".NETFramework,Version=v4.7.2" ascii fullword
		$s9 = ".NET Framework 4.7.2" ascii fullword
		$s10 = "E:\\Work\\Analysis\\" ascii fullword
		$s11 = "[+] File uploaded successfully" wide fullword
		$s12 = "createPost" ascii fullword
		$s13 = "encryptedMessage" ascii fullword
		$s14 = "RedditAgent" wide fullword
		$s15 = "SubmitTextPost" ascii fullword
		$s16 = "GetSubreddit" ascii fullword
		$s17 = "postText" ascii fullword
		$s18 = "xorkey" ascii fullword
		$s19 = "listenerID" ascii fullword
		$s20 = "RedditSharp.Things" ascii fullword
	condition:
		hash.sha256(0, filesize) == "8b534d0f9f699d6a02aca559f2699d914b0b3f8749e0d206bece0fe09b92ccc6" or uint16(0) == 0x5a4d and filesize < 20KB and 8 of them
}

import "hash"

rule SharpC2Dll {
	meta:
		description = "SharpC2 - SharpC2.dll"
		sha256 = "ce0fe31e5c1fe918f766ab2e83daaac9e58cce3972c0872f8d1b2de03417528f"
	strings:
		$s1 = "SharpC2.dll" wide fullword
		$s2 = "RClient.Components.Pivots.ReversePortForwardTable+<OnReversePortForwardCreated>d__7" ascii fullword
		$s3 = "AClient.Components.Pivots.ReversePortForwardTable+<AddForward>d__5" ascii fullword
		$s4 = "RClient.Components.Pivots.ReversePortForwardTable+<OnReversePortForwardDeleted>d__6" ascii fullword
		$s5 = "DClient.Components.Pivots.ReversePortForwardTable+<DeleteForward>d__9" ascii fullword
		$s6 = "HClient.Components.Pivots.ReversePortForwardTable+<OpenCreateForward>d__8" ascii fullword
		$s7 = "__Blazor.Client.Components.Tasks.ProcessListing" ascii fullword
		$s8 = "C:\\Tools\\SharpC2\\Client\\obj\\Release\\net7.0-windows10.0.19041.0\\win10-x64\\SharpC2.pdb" ascii fullword
		$s9 = "IClient.Components.Pivots.ReversePortForwardTable+<OnInitializedAsync>d__4" ascii fullword
		$s10 = "KClient.Components.Pivots.CreateReversePortForward+<OnInitializedAsync>d__12" ascii fullword
		$s11 = "7Client.Components.Handlers.HostAFile+<UploadFiles>d__22" ascii fullword
		$s12 = "SHELLCODE" wide fullword
		$s13 = "Microsoft.ui.xaml.dll" ascii fullword
		$s14 = "0Client.Services.SharpC2Api+<GetHostedFiles>d__26" ascii fullword
		$s15 = "8Client.Services.SharpC2Api+<GetReversePortForwards>d__42" ascii fullword
		$s16 = "7Client.Services.SharpC2Api+<GetReversePortForward>d__43" ascii fullword
		$s17 = "__Blazor.Client.Components.Pivots.CreateReversePortForward" ascii fullword
		$s18 = ";Client.Components.Handlers.HttpHandlers+<OpenHostFile>d__10" ascii fullword
		$s19 = "9Client.Components.Events.WebLogs+<OnInitializedAsync>d__3" ascii fullword
		$s20 = "__Blazor.Client.Components.Pivots.ReversePortForwardTable" ascii fullword
		$s21 = "MemoryStream" ascii fullword
	condition:
		hash.sha256(0, filesize) == "ce0fe31e5c1fe918f766ab2e83daaac9e58cce3972c0872f8d1b2de03417528f" or uint16(0) == 0x5a4d and filesize < 2000KB and 8 of them
}

import "pe"
import "hash"

rule TrevorC2_Win {
	meta:
		description = "TrevorC2 - tc2_client.exe"
		sha256 = "11d05c91663798116f6426c24166bdd648c519f6f95bdff4659dd56c575e7978"
	strings:
		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.37 E"
		$s2 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.37 E"
		$s3 = "  VirtualQuery failed for %d bytes at address %p" ascii fullword
		$s4 = "%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p." ascii fullword
		$s5 = "magic_hostname=%s" ascii fullword
		$s6 = "Tr3v0rC2R0x@nd1s@w350m3#TrevorForget" ascii fullword
		$s7 = "%s?%s%s" ascii fullword
		$s8 = "<!-- oldcss=" ascii fullword
		$s9 = "killnow" ascii fullword
		$s10 = "sessionid=" ascii fullword
		$s11 = "  VirtualProtect failed with code 0x%x" ascii fullword
		$s12 = "Cookie: sessionid=%s" ascii fullword
		$s13 = "  Unknown pseudo relocation protocol version %d." ascii fullword
		$s14 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
		$s15 = "192.168.1.175" ascii fullword
		$s16 = "connect" ascii fullword
		$s17 = "socket" ascii fullword
		$s18 = ":MZuYHcB<H" ascii fullword
		$s19 = "=UUUUw" ascii fullword
		$s20 = "ATUWVSHcY" ascii fullword
	condition:
		hash.sha256(0, filesize) == "11d05c91663798116f6426c24166bdd648c519f6f95bdff4659dd56c575e7978" or pe.imports("ws2_32.dll", "send") and pe.imports("kernel32.dll", "VirtualProtect") and pe.imports("msvcrt.dll", "rand") and pe.imports("kernel32.dll", "VirtualQuery") and uint16(0) == 0x5a4d and filesize < 200KB and 8 of them
}

import "pe"
import "hash"

rule Sqlc2cmds {
	meta:
		description = "Sqlc2cmds - sqlc2cmds.dll"
		sha256 = "019fa586cbbdc875e72e614ab1917a93bcbc14bb0fa1731d0643b93c3763db2a"
	strings:
		$x1 = "C:\\Windows\\System32\\cmd.exe" wide fullword
		$s2 = "sqlc2cmds.dll" wide fullword
		$s3 = "WMI command executed" wide fullword
		$s4 = "\\\\127.0.0.1\\root\\cimv2:Win32_Process" wide fullword
		$s5 = "base64EncodedPayload" ascii fullword
		$s6 = "run_shellcode" ascii fullword
		$s7 = "run_command" ascii fullword
		$s8 = "run_command_ps" ascii fullword
		$s9 = "run_command_wmi" ascii fullword
		$s10 = "run_getusercon" ascii fullword
		$s11 = "send_http_get" ascii fullword
		$s12 = "execTsql" ascii fullword
		$s13 = "get_lsa_secrets" ascii fullword
		$s14 = "send_http_post" ascii fullword
		$s15 = "run_getprocs" ascii fullword
		$s16 = "entriesread" ascii fullword
		$s17 = "read_file_bin" ascii fullword
		$s18 = "fileContent" ascii fullword
		$s19 = "OriginatingHost" ascii fullword
		$s20 = "PostRequest" ascii fullword
	condition:
		hash.sha256(0, filesize) == "019fa586cbbdc875e72e614ab1917a93bcbc14bb0fa1731d0643b93c3763db2a" or uint16(0) == 0x5a4d and filesize < 40KB and 1 of ($x*) and 4 of them
}

comp.id

go.microsoft.com

graph.microsoft.com

api.dropboxapi.com

schemas.microsoft.com

schemas.xmlsoap.org

kali.host

microsoft.windows

sam.save

stage2core.so

dropper.py

res.read

raw.githubusercontent.com

github.com

system.io

0client.services

7client.services

note.gnu.build

libc.so

attack.mitre.org

airstrike-x86.exe

crypt32.dll

wqjs_x64.exe

new.tar

b.dat

calc.exe

cmd.exe

tasks.exe

client.exe

badger_x64.dll

c3oqgc2d.dll

badger_x64_rtlexituserthread.bin

advapi32.dll

badger_x64_stealth_service.exe

badger_x64_waitforsingleobject.bin

badger_x86.dll

badger_x86_rtlexituserthread.bin

badger_x86_waitforsingleobject.bin

syscall_stage_x64_waitforsingleobject.bin

syscall_stage_x86_waitforsingleobject.bin

noderelaydll_r86.dll

winhttp.dll

outlookc2client.exe

outlookc2client.dll

uration.config

dbc2_agent.exe

minidump.exe

samdump.exe

attributerpc.reg

rof.dll

zoneinfo.zip

agent_x86.exe

exchanger_x86.exe

dllhijack.dll

mikec2.exe

drawing.dll

ws2_32.dll

reg.exe

_samdump.zip

getjuice.php

test.exe

c:\\windows\\temp\\1.txt

powershell.exe

dynamiccode.exe

pbind.exe

dropper.exe

dropper.ps1

a.key

urllib2.url

keylogger.py

shell.js

http.js

operatingsystemversionstring.js

pbind.ps1

implant.py

sharpc2.exe

'kernel32.dll

xaml.dll

tc2_client.exe

sqlc2cmds.dll

empireproject

31d6cfe0d16ae931b73c59d7e0c089c0

554889e54157415641554d89c5415457

554889e541574156415541544989d4ba

558b7c2458033b893c24e8970400003b

fcd1a3d32b4c37a392c59ffe241b9cb973fde7f4

be80b172b1e5fd000f5e638ebc8289b9940fa4ca51b75b0dd92ca633cbf1fcb9

68a4cd4fcf1f9a0e3a68ac19621adcb214f830c0854f7a9ad18ce453174d31a0

c703ffb19774194cbdd674c3feb12ef9942a242ab6569a6e153ba846cf4de852

6382401da4b33f85be0491f73d26080748821f25ce457dfee4c55c43308867c4

039586f2d56ef93343980bf7734c350f6898acc457c1bae184391439c1820d86

d6fd0dd6a3a4bde08a2354e9298c1dacc6495c2173100b489e3c1d4526817a40

a72a9b039ddd668ce86022621c6d073048b0d4ab38beb0d9bc98287e5a14c206

a453b3510ef0aa993b88f49d2a6f7a85bfab407033afb23340287b94eddff86d

b33dc013e2168ebb37d8ac80dbcd778c6bda2ede4927b47ec95f32c87ad125fd

b67570680ffd7ebf5c8479e364c7a50ccf293170feb195172b9d907b5f171a88

ddd797f2afb0f0cf3e85532d937e475f3af778b6032b979f3b739904b2c7bc07

defaacd4c05addae13998f3dce82e12e2f8f7c48af1e9061071f8157f01f7b61

86979aca65aef25f18132a2fc328f3d9234298e9d9c3b6cbd4a98a1ac7728c9d

3fcc85c86db9e7f5e218d56af9f7ecabbf0284e447c3a70a14c89138d33d384b

e9eccdb3b023ef3e8d267ff8f32e957b75711b5489cd5df3a000ab7cac53155e

1b13d5dab78b7b6c4d85ec5eb9e60854c37287384d7266d5c6583b8367f69583

9de63114a0173f1c599cb4035961ce400ffeea6a178f4a89ee542972dcd42154

ab2ee8a4068329fe2731d82c7ffa31ea1262f67ea08afa58bcd3280b3fbf6324

efa977d502ce60fd5d596b64ff5bd07bb7fa71eb956bc8ca1e33dd23b68a4d8c

8be0f684decfa6e675d9c9b38590222139b088fa236651b73d1a01f5994a7666

434a0fa442b1322e654142fe6a8bc35df3bcdebacb030ba68c4644f96df5caac

b25288c94464546446ee1f9d3b361f979895392219b4316645945dbb6ed045b9

ac99a80277cd93f35df6a962fb13fe807a28328433e5d1d8765a13e9bc9562cc

34f4c3c83c8f700980f464f4f0b17e651c32dd2468fa93d6be65feccdefcb9d7

596a12d0c792569148bf5404d3074ba4fe0fff0f14f48f3244463d0d7a83f5ca

2b1f466ab2c78bb3f8fd287a7cb3c87922317fe7cd348aa699e57b285544c2a9

ca83ab01d46925f1d3a559affd3398d1cfe5d0abd637413cd5ae25f1fe7bd008

96d0bec95be57bb098632ab49eb8a2f23d3a7c9dc1e288a5fb990fa5ccec1bca

066857279d1e93a2ffdb1df8e1d509f6cc58a60083674e842a1e178cf1483904

045312cb098438fe9dbcecf713766bff29d171726fb228de92ef54447564bbb4

d5a3de19ef84c040a5b0058fb4fb2a036c9a8db7495763bcc7b7070f16cde967

195a255225c246f360d80e4ac4287cbcd4ca8025a68631dfa3c28b365cd5a25c

eaf734a532b9312168cbcbbea00d08171546bc8560b7131904bd5ea77090e9d3

2e8341a042e4c26fa6cfe2606075a56aa47587b7ca934789da3cb486cca871b7

b059fc8cce2a0ca169dd3aae76c13d43a3fee0821a2bbb5b0d8b97d067c6eb08

c337983b7eefbea3cc02e4d011398292ccbd475ba932ced40603a4a9a3927032

933241f02ef81bef5f6b51ce3e5b3dbf242c829f899f64d2f10b0bad668a6424

9fb7870c7c1dc8d2dd61ba77e34efe580ad0151c9b59b201b17a45a211d8ff49

8ed63f7ea1a79dbf2cc9a338feff1dd4491a9daac38d4c86f67d7211783ae272

df8474fe610372aff283b0429626e1663b27e7c651242fbc7687ca6fd2d45caa

f770e4b68e8d911e51a4de4cd84b36f290b7fcabe866063e26cee47afd98ba6c

a7fbb82f2606e3ec217d94fe83d4127e3a5a47290141875ff150243024fb2259

1193794ebfc3f9ae58e6bb443ecd783274285396c8b23533683e10da0c9d5c53

a7f763a818db6da6433b4ffcafbbbd680597fee28bb97760ddd384caf0c25992

8653f19782f1e19e86caf6fdadc17790eb9d68ff34c8a249e9e9e26ba8000c88

6d520463f8563d6a296d22b6824c690c9b6de8121c9b6f08307947874667c5f2

dd654eb75c1f3736d4b5282e7338a5efcbd7481fc7b46ec38a3ff0ea573c408e

03c10e261a138666a1c5cf9cb577e8d73e041b1dae0a3d1198d116e4c2b5dec3

ce950ee11e27e0a95840fa12c878af19910aa82d1ccd5eb99ab99c4131571989

ddc5047d6a8bb245644c5385ead8fa0d3b751f2aabf9e88e423e0b9862e65019

dba80b543f6d39f2d0631f6cfebef961259746e6f70fb0cf1431e85343ba7d32

162fc5cdd4ed03ab16da5edd076bc05e87dae1a41b053dddbcc8cac06baa8a63

720ded9560168b206152cceab0fcfa8138ad92311a0cf4b5bdf7ba0bd8074839

39391bffd11e6e525b02ea4cd5b3b4422c072126424b7031db346d260a4bd127

192.168.17.131

1.0.0.0

10.0.0.1

192.168.1.175

sharpc2.pdb

https://go.microsoft.com/fwlink/?linkid=798306

https://graph.microsoft.com/.default

https://content.dropboxapi.com/2/files/upload

https://api.dropboxapi.com/2/files/list_folder

https://api.dropboxapi.com/2/files/delete

http://www.w3.org/2001/xmlschema

http://kali.host/mikec2.exe

http://127.0.0.1/shellcode.bin

https://github.com/its-a-feature/mythic/blob/master/payload_types/apfell/agent_code/shell.js#l2

https://github.com/its-a-feature/mythic/blob/master/payload_types/apfell/agent_code/base/apfell-jxa.js#l116

https://github.com/its-a-feature/mythic/blob/master/payload_types/apfell/agent_code/base/apfell-jxa.js#l9

https://github.com/its-a-feature/mythic/blob/master/payload_types/apfell/agent_code/base/apfell-jxa.js#l2

https://howto.thec2matrix.com

import "hash"
import "pe"

rule AirStrike {
	meta:
		description = "AirStrike - AirStrike-x64.exe, AirStrike-x86.exe"
		sha256_1 = "be80b172b1e5fd000f5e638ebc8289b9940fa4ca51b75b0dd92ca633cbf1fcb9"
		sha256_2 = "582886d688fb0e3573afa5f39c7984a2fe99d2ffb50543d354d9286c44dbd1ad"
	strings:
		$s1 = "[-] Copied shellcode to memory" ascii fullword
		$s2 = "[-] Received shellcode of size %d" ascii fullword
		$s3 = "username=%s&pid=%d&machine=%s&domain=%s&arch=%s&process=%s&version=%s" ascii fullword
		$s4 = "[+] Killing process" ascii fullword
		$s5 = "        <requestedExecutionLevel level='asInvoker' uiAccess='false' />" ascii fullword
		$s6 = "[-] Thread finished" ascii fullword
		$s7 = "[-] Created thread" ascii fullword
		$s8 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" ascii fullword
		$s9 = "[-] Changed memory protection" ascii fullword
		$s10 = "[+] Request sent" ascii fullword
		$s11 = "[-] Received response of size %d" ascii fullword
		$s12 = "[+] Data: %s" ascii fullword
		$s13 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" ascii fullword
		$s14 = "X-Session-ID: %s" ascii fullword
		$s15 = "192.168.17.131" ascii fullword
		$s16 = ".rdata$voltmd" ascii fullword
		$s17 = "  </trustInfo>" ascii fullword
		$s18 = "[-] Allocated memory at %p" ascii fullword
		$s19 = "_get_initial_narrow_environment" ascii fullword
		$s20 = "_set_app_type" ascii fullword
	condition:
		hash.sha256(0, filesize) == "be80b172b1e5fd000f5e638ebc8289b9940fa4ca51b75b0dd92ca633cbf1fcb9" or hash.sha256(0, filesize) == "582886d688fb0e3573afa5f39c7984a2fe99d2ffb50543d354d9286c44dbd1ad" or pe.imports("kernel32.dll", "VirtualProtect") and pe.imports("kernel32.dll", "TerminateProcess") and pe.imports("crypt32.dll", "CryptBinaryToStringW") and pe.imports("wininet.dll", "InternetConnectW") and ((uint16(0) == 0x5a4d and filesize < 40KB and (8 of them)) or (all of them))
}

import "hash"

rule AM0NEye_AmsiInject {
	meta:
		description = "AM0NEye - amsi-inject.o"
		sha256 = "c703ffb19774194cbdd674c3feb12ef9942a242ab6569a6e153ba846cf4de852"
	strings:
		$x1 = "Fail - Could not patch AMSI.AmsiOpenSession in remote process: PID:%d" ascii fullword
		$s2 = "Success - Patched AMSI.AmsiOpenSession in remote process: PID:%d" ascii fullword
		$s3 = "amsi.dll" ascii fullword
		$s4 = "Attempting to patch AMSI in remote process with PID: %d" ascii fullword
		$s5 = "__imp_KERNEL32$OpenProcess" ascii fullword
		$s6 = "__imp_KERNEL32$WriteProcessMemory" ascii fullword
		$s7 = "amsi-inject.c" ascii fullword
		$s8 = "__imp_KERNEL32$GetProcAddress" ascii fullword
		$s9 = "__imp_KERNEL32$CloseHandle" ascii fullword
		$s10 = "__imp_KERNEL32$LoadLibraryA" ascii fullword
		$s11 = "patchAmsiOpenSession" ascii fullword
		$s12 = "__imp_BeaconDataInt" ascii fullword
		$s13 = "AmsiOpenSession" ascii fullword
		$s14 = "GCC: (GNU) 10-win32 20220324" ascii fullword
		$s15 = "P@.xdata" ascii fullword
	condition:
		hash.sha256(0, filesize) == "c703ffb19774194cbdd674c3feb12ef9942a242ab6569a6e153ba846cf4de852" or uint16(0) == 0x8664 and filesize < 5KB and 1 of ($x*) and 4 of them
}