YARA Detection Rule: APT10_Malware_Sample_Gen
Repository: Neo23x0/signature-base
Detects: APT 10 / Cloud Hopper malware campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html

Pattern signatures:
$c2_1 = "[PII_REDACTED]59681.r3u8.com" ascii
      $c2_2 = "[PII_REDACTED]46049.r3u8.com" ascii
      $c2_3 = "0625.have8000.com" ascii
      $c2_4 = "1.gadskysun.com" ascii
      $c2_5 = "100fanwen.com" ascii
      $c2_6 = "11.usyahooapis.com" ascii
      $c2_7 = "[PII_REDACTED].r3u8.com" ascii
      $c2_8 = "[PII_REDACTED].r3u8.com" ascii
      $c2_9 = "1j.www1.biz" ascii
      $c2_10 = "1z.itsaol.com" ascii
      $c2_11 = "2012yearleft.com" ascii
      $c2_12 = "2014.zzux.com" ascii
      $c2_13 = "202017845.r3u8.com" ascii
      $c2_14 = "[PII_REDACTED]784.r3u8.com" ascii
      $c2_15 = "[PII_REDACTED].r3u8.com" ascii
      $c2_16 = "[PII_REDACTED].r3u8.com" ascii
      $c2_17 = "5q.niushenghuo.info" ascii
      $c2_18 = "6r.suibian2010.info" ascii
      $c2_19 = "9gowg.tech" ascii
      $c2_20 = "Hamiltion.catholicmmb.com" ascii
      $c2_21 = "a.wubangtu.info" ascii
      $c2_22 = "a1.suibian2010.info" ascii
      $c2_24 = "abc.wikaba.com" ascii
      $c2_25 = "abcd[PII_REDACTED].org" ascii


Detection condition:
1 of ($c2_*)

Full rule:
rule APT10_Malware_Sample_Gen : FILE {
   meta:
      description = "APT 10 / Cloud Hopper malware campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
      date = "2017-04-06"
      score = 80
   strings:
      $c2_1 = "[PII_REDACTED]59681.r3u8.com" ascii
      $c2_2 = "[PII_REDACTED]46049.r3u8.com" ascii
      $c2_3 = "0625.have8000.com" ascii
      $c2_4 = "1.gadskysun.com" ascii
      $c2_5 = "100fanwen.com" ascii
      $c2_6 = "11.usyahooapis.com" ascii
      $c2_7 = "[PII_REDACTED].r3u8.com" ascii
      $c2_8 = "[PII_REDACTED].r3u8.com" ascii
      $c2_9 = "1j.www1.biz" ascii
      $c2_10 = "1z.itsaol.com" ascii
      $c2_11 = "2012yearleft.com" ascii
      $c2_12 = "2014.zzux.com" ascii
      $c2_13 = "202017845.r3u8.com" ascii
      $c2_14 = "[PII_REDACTED]784.r3u8.com" ascii
      $c2_15 = "[PII_REDACTED].r3u8.com" ascii
      $c2_16 = "[PII_REDACTED].r3u8.com" ascii
      $c2_17 = "5q.niushenghuo.info" ascii
      $c2_18 = "6r.suibian2010.info" ascii
      $c2_19 = "9gowg.tech" ascii
      $c2_20 = "Hamiltion.catholicmmb.com" ascii
      $c2_21 = "a.wubangtu.info" ascii
      $c2_22 = "a1.suibian2010.info" ascii
      $c2_24 = "abc.wikaba.com" ascii
      $c2_25 = "abcd[PII_REDACTED].org" ascii
      $c2_26 = "abcd[PII_REDACTED].org" ascii
      $c2_27 = "acc.emailfound.info" ascii
      $c2_28 = "acc.lehigtapp.com" ascii
      $c2_29 = "acsocietyy.com" ascii
      $c2_31 = "ad.webbooting.com" ascii
      $c2_32 = "additional.sexidude.com" ascii
      $c2_33 = "af.zyns.com" ascii
      $c2_34 = "afc.https443.org" ascii
      $c2_35 = "ako.ddns.us" ascii
      $c2_36 = "androidmusicapp.onmypc.us" ascii
      $c2_37 = "announcements.toythieves.com" ascii
      $c2_38 = "anvprn.com" ascii
      $c2_39 = "aotuo.9966.org" ascii
      $c2_40 = "apec.qtso