“ and ” will occur syntax error, they should be changed to ". 
XOR_DDosv1(4): syntax error, unexpected $end, expecting _NUMBER_ or _TEXT_STRING_ or _TRUE_ or _FALSE_

The weight can't be 0(default is 100).

It should be Ransomware instead of Ramsonware.

We have deleted duplicated rule

We have deleted duplicated rules

We rules with external vars

This rule works with external variables.

After the rule in issue #39 was commented out, the APT1_aspnetreport, and APT1_dbg_mess got borked, since both rules depended on the APT1_payloads.

Bugfix

Add Threatgroup 3390 rules from Loki. https://github.com/Neo23x0/Loki/blob/9115483427fc110ce022f33434b818a0092c5242/signatures/apt_threatgroup_3390.yar