deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT30_Sample_31
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "\\ZJRsv.tem" ascii
		$s1 = "forceguest" fullword ascii
		$s4 = "\\$NtUninstallKB570317$" ascii
		$s8 = "[Can'tGetIP]" fullword ascii
		$s14 = "QWERTY:,`/" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_31 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "8b[PII_REDACTED]787be[PII_REDACTED]25eae5043aca"
		id = "9333870b-7eaa-54dd-a[PII_REDACTED]fb592"
	strings:
		$s0 = "\\ZJRsv.tem" ascii
		$s1 = "forceguest" fullword ascii
		$s4 = "\\$NtUninstallKB570317$" ascii
		$s8 = "[Can'tGetIP]" fullword ascii
		$s14 = "QWERTY:,`/" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_J
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Launcher.EXE" fullword wide
		$s1 = "Symantec Security Technologies" fullword wide
		$s2 = "\\Symantec LiveUpdate.lnk" ascii
		$s3 = "Symantec Service Framework" fullword wide
		$s4 = "\\ccSvcHst.exe" ascii
		$s5 = "\\wssfmgr.exe" ascii
		$s6 = "Symantec Corporation" fullword wide
		$s7 = "\\5.1.0.29" ascii
		$s8 = "\\Engine" ascii
		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
		$s10 = "Symantec LiveUpdate" fullword ascii
		$s11 = "\\Norton360" ascii
		$s15 = "BinRes" fullword ascii
		$s16 = "\\readme.lz" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_J {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "49aca228674651cba776be727bdb7e60"
		hash2 = "5c7a6b3d1b85fad17333e[PII_REDACTED]3"
		hash3 = "649fa64127fef1305ba141dd58fb83a5"
		hash4 = "9982fd829c0048c8f[PII_REDACTED]6763a"
		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
		hash6 = "9982fd829c0048c8f[PII_REDACTED]6763a"
		id = "64a5106e-d7f3-5c68-a14e-410149a1bb9e"
	strings:
		$s0 = "Launcher.EXE" fullword wide
		$s1 = "Symantec Security Technologies" fullword wide
		$s2 = "\\Symantec LiveUpdate.lnk" ascii
		$s3 = "Symantec Service Framework" fullword wide
		$s4 = "\\ccSvcHst.exe" ascii
		$s5 = "\\wssfmgr.exe" ascii
		$s6 = "Symantec Corporation" fullword wide
		$s7 = "\\5.1.0.29" ascii
		$s8 = "\\Engine" ascii
		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
		$s10 = "Symantec LiveUpdate" fullword ascii
		$s11 = "\\Norton360" ascii
		$s15 = "BinRes" fullword ascii
		$s16 = "\\readme.lz" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Microfost
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
		$s2 = "Microfost" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Microfost {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
		id = "19231001-1da3-5be6-8275-03c9fc7c6377"
	strings:
		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
		$s2 = "Microfost" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_K
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$x1 = "Maybe a Encrypted Flash" fullword ascii

      $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
      $s1 = "\\TEMP\\" ascii
      $s2 = "\\Temporary Internet Files\\" ascii
      $s5 = "%s Size:%u Bytes" fullword ascii
      $s7 = "$.DATA$" fullword ascii
      $s10 = "? Size:%u By s" fullword ascii
      $s12 = "Maybe a Encrypted Flash" fullword ascii
      $s14 = "Name:%-32s" fullword ascii
      $s15 = "NickName:%-32s" fullword ascii
      $s19 = "Email:%-32s" fullword ascii
      $s21 = "C:\\Prog" ascii
      $s22 = "$LDDATA$" ascii
      $s31 = "Copy File %s OK!" fullword ascii
      $s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
      $s34 = "open=%s" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and ( all of ($x*) and 3 of ($s*) )

Full rule:
rule APT30_Generic_K {
   meta:
      description = "FireEye APT30 Report Sample"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
      date = "2015/04/03"
      modified = "2023-01-06"
      score = 75
      hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
      id = "49[PII_REDACTED]-5d74-b763-b2500536eb90"
   strings:
      $x1 = "Maybe a Encrypted Flash" fullword ascii

      $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
      $s1 = "\\TEMP\\" ascii
      $s2 = "\\Temporary Internet Files\\" ascii
      $s5 = "%s Size:%u Bytes" fullword ascii
      $s7 = "$.DATA$" fullword ascii
      $s10 = "? Size:%u By s" fullword ascii
      $s12 = "Maybe a Encrypted Flash" fullword ascii
      $s14 = "Name:%-32s" fullword ascii
      $s15 = "NickName:%-32s" fullword ascii
      $s19 = "Email:%-32s" fullword ascii
      $s21 = "C:\\Prog" ascii
      $s22 = "$LDDATA$" ascii
      $s31 = "Copy File %s OK!" fullword ascii
      $s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
      $s34 = "open=%s" fullword ascii
   condition:
      filesize < 100KB and uint16(0) == 0x5A4D and ( all of ($x*) and 3 of ($s*) )
}
YARA Detection Rule: APT30_Sample_33
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Version 4.7.3001" fullword wide
		$s1 = "msmsgr.exe" fullword wide
		$s2 = "MYUSER32.dll" fullword ascii
		$s3 = "MYADVAPI32.dll" fullword ascii
		$s4 = "CeleWare.NET1" fullword ascii
		$s6 = "MYMSVCRT.dll" fullword ascii
		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
		$s8 = "WWW.CeleWare.NET1" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and 6 of them

Full rule:
rule APT30_Sample_33 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
		id = "be6afc4a-97fe-56ba-b057-e21415f9833d"
	strings:
		$s0 = "Version 4.7.3001" fullword wide
		$s1 = "msmsgr.exe" fullword wide
		$s2 = "MYUSER32.dll" fullword ascii
		$s3 = "MYADVAPI32.dll" fullword ascii
		$s4 = "CeleWare.NET1" fullword ascii
		$s6 = "MYMSVCRT.dll" fullword ascii
		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
		$s8 = "WWW.CeleWare.NET1" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and 6 of them
}
YARA Detection Rule: APT30_Sample_34
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "dizhi.gif" ascii
		$s1 = "eagles.vip.nse" ascii
		$s4 = "o%S:S0" ascii
		$s5 = "la/4.0" ascii
		$s6 = "s#!<4!2>s02==<'s1" ascii
		$s7 = "HlobalAl" ascii
		$s9 = "vcMicrosoftHaveAck7"  ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_34 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
		id = "a4802e13-4151-5f17-ba91-dcf9ef6b52bb"
	strings:
		$s0 = "dizhi.gif" ascii
		$s1 = "eagles.vip.nse" ascii
		$s4 = "o%S:S0" ascii
		$s5 = "la/4.0" ascii
		$s6 = "s#!<4!2>s02==<'s1" ascii
		$s7 = "HlobalAl" ascii
		$s9 = "vcMicrosoftHaveAck7"  ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_35
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
		$s5 = "Startup>A" fullword ascii
		$s18 = "olhelp32Snapshot" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_35 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
		id = "8a30720b-06da-5a82-8bab-bf06121afd68"
	strings:
		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
		$s5 = "Startup>A" fullword ascii
		$s18 = "olhelp32Snapshot" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_1
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "#hostid" fullword ascii
		$s1 = "\\Windows\\C" ascii
		$s5 = "TimUmove" fullword ascii
		$s6 = "Moziea/4.0 (c" fullword ascii
		$s7 = "StartupNA" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_1 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "#hostid" fullword ascii
		$s1 = "\\Windows\\C" ascii
		$s5 = "TimUmove" fullword ascii
		$s6 = "Moziea/4.0 (c" fullword ascii
		$s7 = "StartupNA" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_1
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "%s\\%s.txt" fullword
		$s1 = "\\ldsysinfo.txt"
		$s4 = "(Extended Wansung)" fullword
		$s6 = "Computer Name:" fullword
		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
		$s8 = "ASSAMESE" fullword
		$s9 = "BELARUSIAN" fullword
		$s10 = "(PR China)" fullword
		$s14 = "(French)" fullword
		$s15 = "AdvancedServer" fullword
		$s16 = "DataCenterServer" fullword
		$s18 = "(Finland)" fullword
		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
		$s20 = "(Chile)" fullword

Detection condition:
filesize < 250KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_1 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
		id = "4d21f402-24da-5e38-9225-a1461e61802f"
	strings:
		$s0 = "%s\\%s.txt" fullword
		$s1 = "\\ldsysinfo.txt"
		$s4 = "(Extended Wansung)" fullword
		$s6 = "Computer Name:" fullword
		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
		$s8 = "ASSAMESE" fullword
		$s9 = "BELARUSIAN" fullword
		$s10 = "(PR China)" fullword
		$s14 = "(French)" fullword
		$s15 = "AdvancedServer" fullword
		$s16 = "DataCenterServer" fullword
		$s18 = "(Finland)" fullword
		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
		$s20 = "(Chile)" fullword
	condition:
		filesize < 250KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_2
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample - from many files
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "%s\\%s\\KB985109.log" fullword
		$s1 = "%s\\%s\\KB989109.log" fullword
		$s2 = "Opera.exe" fullword wide
		$s3 = "%s:All online success on %u!" fullword
		$s4 = "%s:list online success on %u!" fullword
		$s5 = "%s:All online fail!" fullword
		$s6 = "Copyright Opera Software 1995-" wide
		$s7 = "%s:list online fail!" fullword
		$s8 = "OnlineTmp.txt" fullword
		$s9 = "Opera Internet Browser" fullword wide
		$s12 = "Opera Software" fullword wide
		$s15 = "Check lan have done!!!" fullword
		$s16 = "List End." fullword

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_2 {
	meta:
		description = "FireEye APT30 Report Sample - from many files"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
		hash2 = "94d3f91d1e50ecea[PII_REDACTED]13c3d143bf2c3e"
		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
		hash8 = "1ef415bca[PII_REDACTED]34fc97b0aa720943ba512"
		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
		id = "60d7d661-50e8-5a9b-8366-eda8ff
YARA Detection Rule: APT30_Generic_3
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Acrobat.exe" fullword wide
		$s14 = "********************************" fullword
		$s16 = "FFFF:>>>>>>>>>>>>>>>>>@" fullword

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_3 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "b90ac3e58ed472829e2562023e6e892d2d61ac44"
		hash1 = "342036ace2e9e6d504b0dec6399e4fa92de46c12"
		hash2 = "5cdf397dfd9eb66ff5ff636777f6982c1254a37a"
	strings:
		$s0 = "Acrobat.exe" fullword wide
		$s14 = "********************************" fullword
		$s16 = "FFFF:>>>>>>>>>>>>>>>>>@" fullword
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_4
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "del NetEagle_Scout.bat" fullword
		$s1 = "NetEagle_Scout.bat" fullword
		$s2 = "\\visit.exe"
		$s3 = "\\System.exe"
		$s4 = "\\System.dat"
		$s5 = "\\ieupdate.exe"
		$s6 = "GOTO ERROR" fullword
		$s7 = ":ERROR" fullword
		$s9 = "IF EXIST " fullword
		$s10 = "ioiocn" fullword
		$s11 = "SetFileAttribute" fullword
		$s12 = "le_0*^il" fullword
		$s13 = "le_.*^il" fullword
		$s14 = "le_-*^il" fullword

Detection condition:
filesize < 250KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_4 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
		hash1 = "b47e20ac[PII_REDACTED]dc241f28f4e224070810d2"
		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
		id = "2b246ae2-ec7d-5813-913e-729e4192da59"
	strings:
		$s0 = "del NetEagle_Scout.bat" fullword
		$s1 = "NetEagle_Scout.bat" fullword
		$s2 = "\\visit.exe"
		$s3 = "\\System.exe"
		$s4 = "\\System.dat"
		$s5 = "\\ieupdate.exe"
		$s6 = "GOTO ERROR" fullword
		$s7 = ":ERROR" fullword
		$s9 = "IF EXIST " fullword
		$s10 = "ioiocn" fullword
		$s11 = "SetFileAttribute" fullword
		$s12 = "le_0*^il" fullword
		$s13 = "le_.*^il" fullword
		$s14 = "le_-*^il" fullword
	condition:
		filesize < 250KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_5
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
		$s1 = "name=\"ftpserver.exe\"/>" fullword
		$s2 = "LiveUpdate.EXE" fullword wide
		$s3 = "<description>FTP Explorer</description>" fullword
		$s4 = "\\ashelper.dll"
		$s5 = "LiveUpdate" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_5 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
		hash1 = "dfc9a87df2d585c479ab[PII_REDACTED]4b055d156f"
		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
		id = "e00a670e-cd95-515f-8109-219ce5121ba4"
	strings:
		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
		$s1 = "name=\"ftpserver.exe\"/>" fullword
		$s2 = "LiveUpdate.EXE" fullword wide
		$s3 = "<description>FTP Explorer</description>" fullword
		$s4 = "\\ashelper.dll"
		$s5 = "LiveUpdate" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_6
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "GetStar" fullword
		$s1 = ".rdUaS" fullword
		$s2 = "%sOTwp/&A\\L" fullword
		$s3 = "a Encrt% Flash Disk" fullword
		$s4 = "ypeAutoRuChec" fullword
		$s5 = "NoDriveT" fullword

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_6 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
		hash2 = "5d39a567b50c74c4a921b5f65713f[PII_REDACTED]3"
		id = "dfd104bd-daf4-593a-b161-61f43aec048c"
	strings:
		$s0 = "GetStar" fullword
		$s1 = ".rdUaS" fullword
		$s2 = "%sOTwp/&A\\L" fullword
		$s3 = "a Encrt% Flash Disk" fullword
		$s4 = "ypeAutoRuChec" fullword
		$s5 = "NoDriveT" fullword
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_7
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "Xjapor_*ata" fullword
		$s2 = "Xjapor_o*ata" fullword
		$s4 = "Ouopai" fullword

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_7 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
		hash2 = "0263de239ccef669c47399856d481e3361408e90"
		id = "bba40092-267b-5231-92f1-f222c9f888ee"
	strings:
		$s1 = "Xjapor_*ata" fullword
		$s2 = "Xjapor_o*ata" fullword
		$s4 = "Ouopai" fullword
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}