deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT30_Sample_18
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "w.km-nyc.com" fullword ascii
		$s1 = "tscv.exe" fullword ascii
		$s2 = "Exit/app.htm" ascii
		$s3 = "UBD:\\D" ascii
		$s4 = "LastError" ascii
		$s5 = "MicrosoftHaveAck" ascii
		$s7 = "HHOSTR" ascii
		$s20 = "XPL0RE." ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_18 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "w.km-nyc.com" fullword ascii
		$s1 = "tscv.exe" fullword ascii
		$s2 = "Exit/app.htm" ascii
		$s3 = "UBD:\\D" ascii
		$s4 = "LastError" ascii
		$s5 = "MicrosoftHaveAck" ascii
		$s7 = "HHOSTR" ascii
		$s20 = "XPL0RE." ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_G
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "%s\\%s\\%s=%s" fullword ascii
		$s1 = "Copy File %s OK!" fullword ascii
		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
		$s4 = "open=%s" fullword ascii
		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_G {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "1612b392d6145bfb0c43f8a48d78c75f"
		hash = "53f1358cbc298da96ec56e9a08851b4b"
		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
		hash = "f18be055fae2490221c926e2ad55ab11"
		id = "34269de3-4559-58a5-a621-0ad72857dc9e"
	strings:
		$s0 = "%s\\%s\\%s=%s" fullword ascii
		$s1 = "Copy File %s OK!" fullword ascii
		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
		$s4 = "open=%s" fullword ascii
		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_19
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
      $s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
      $s2 = "\\TEMP\\" ascii
      $s3 = "\\Temporary Internet Files\\" ascii
      $s5 = "%s TotalSize:%u Bytes" fullword ascii
      $s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
      $s7 = "User:%-32s" fullword ascii
      $s8 = "\\Desktop\\" ascii
      $s9 = "%s.%u_%u" fullword ascii
      $s10 = "Nick:%-32s" fullword ascii
      $s11 = "E-mail:%-32s" fullword ascii
      $s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
      $s14 = "Type:%-8s" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and 8 of them

Full rule:
rule APT30_Sample_19 {
   meta:
      description = "FireEye APT30 Report Sample"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
      date = "2015/04/03"
      modified = "2023-01-06"
      score = 75
      hash = "cfa438449715b61bffa20130df8af778ef011e15"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
   strings:
      $s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
      $s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
      $s2 = "\\TEMP\\" ascii
      $s3 = "\\Temporary Internet Files\\" ascii
      $s5 = "%s TotalSize:%u Bytes" fullword ascii
      $s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
      $s7 = "User:%-32s" fullword ascii
      $s8 = "\\Desktop\\" ascii
      $s9 = "%s.%u_%u" fullword ascii
      $s10 = "Nick:%-32s" fullword ascii
      $s11 = "E-mail:%-32s" fullword ascii
      $s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
      $s14 = "Type:%-8s" fullword ascii
   condition:
      filesize < 100KB and uint16(0) == 0x5A4D and 8 of them
}
YARA Detection Rule: APT30_Generic_E_v2
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_E_v2 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
		id = "40897687-fb17-568e-9907-e9588a53bbe0"
	strings:
		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_20
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "dizhi.gif" fullword ascii
		$s2 = "Mozilla/u" ascii
		$s3 = "XicrosoftHaveAck" ascii
		$s4 = "flyeagles" ascii
		$s10 = "iexplore." ascii
		$s13 = "WindowsGV" fullword ascii
		$s16 = "CatePipe" fullword ascii
		$s17 = "'QWERTY:/webpage3" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_20 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
		id = "91246101-246b-5da9-9e55-7f361d1f6437"
	strings:
		$s0 = "dizhi.gif" fullword ascii
		$s2 = "Mozilla/u" ascii
		$s3 = "XicrosoftHaveAck" ascii
		$s4 = "flyeagles" ascii
		$s10 = "iexplore." ascii
		$s13 = "WindowsGV" fullword ascii
		$s16 = "CatePipe" fullword ascii
		$s17 = "'QWERTY:/webpage3" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_21
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Service.dll" fullword ascii
		$s1 = "(%s:%s %s)" fullword ascii
		$s2 = "%s \"%s\",%s %s" fullword ascii
		$s5 = "Proxy-%s:%u" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_21 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "d315daa61126616a79a[PII_REDACTED]d8a1565c615"
		id = "72005b40-91f7-5661-9478-8680f999b245"
	strings:
		$s0 = "Service.dll" fullword ascii
		$s1 = "(%s:%s %s)" fullword ascii
		$s2 = "%s \"%s\",%s %s" fullword ascii
		$s5 = "Proxy-%s:%u" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_22
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "(\\TEMP" fullword ascii
		$s2 = "Windows\\Cur" fullword ascii
		$s3 = "LSSAS.exeJ" fullword ascii
		$s4 = "QC:\\WINDOWS" fullword ascii
		$s5 = "System Volume" fullword ascii
		$s8 = "PROGRAM FILE" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_22 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
		id = "6c1b3dd2-4383-51a2-9185-2365a4d1e784"
	strings:
		$s1 = "(\\TEMP" fullword ascii
		$s2 = "Windows\\Cur" fullword ascii
		$s3 = "LSSAS.exeJ" fullword ascii
		$s4 = "QC:\\WINDOWS" fullword ascii
		$s5 = "System Volume" fullword ascii
		$s8 = "PROGRAM FILE" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_F
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "\\~zlzl.exe" ascii
		$s2 = "\\Internet Exp1orer" ascii
		$s3 = "NodAndKabIsExcellent" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_F {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
		hash2 = "4c10a1efed25b828e4785d9526507fbc"
		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
		hash4 = "df1799845b51300b03072c6569ab96d5"
		id = "cff8b921-9afc-5a52-84cb-825de33fc86e"
	strings:
		$s0 = "\\~zlzl.exe" ascii
		$s2 = "\\Internet Exp1orer" ascii
		$s3 = "NodAndKabIsExcellent" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_23
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "hostid" ascii
		$s1 = "\\Window" ascii
		$s2 = "%u:%u%s" fullword ascii
		$s5 = "S2tware\\Mic" ascii
		$s6 = "la/4.0 (compa" ascii
		$s7 = "NameACKernel" fullword ascii
		$s12 = "ToWideChc[lo" fullword ascii
		$s14 = "help32SnapshotfL" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_23 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
		id = "9366dd34-9967-5b40-935e-4b0d8f2f5e9e"
	strings:
		$s0 = "hostid" ascii
		$s1 = "\\Window" ascii
		$s2 = "%u:%u%s" fullword ascii
		$s5 = "S2tware\\Mic" ascii
		$s6 = "la/4.0 (compa" ascii
		$s7 = "NameACKernel" fullword ascii
		$s12 = "ToWideChc[lo" fullword ascii
		$s14 = "help32SnapshotfL" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_24
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "dizhi.gif" fullword ascii
		$s3 = "Mozilla/4.0" fullword ascii
		$s4 = "lyeagles" fullword ascii
		$s6 = "HHOSTR" ascii
		$s7 = "#MicrosoftHaveAck7" ascii
		$s8 = "iexplore." fullword ascii
		$s17 = "ModuleH" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_24 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
		id = "aed2201d-b557-56ec-aa53-fff5b1e17dbd"
	strings:
		$s1 = "dizhi.gif" fullword ascii
		$s3 = "Mozilla/4.0" fullword ascii
		$s4 = "lyeagles" fullword ascii
		$s6 = "HHOSTR" ascii
		$s7 = "#MicrosoftHaveAck7" ascii
		$s8 = "iexplore." fullword ascii
		$s17 = "ModuleH" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_25
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "C:\\WINDOWS" fullword ascii
		$s2 = "aragua" fullword ascii
		$s4 = "\\driver32\\7$" ascii
		$s8 = "System V" fullword ascii
		$s9 = "Compu~r" fullword ascii
		$s10 = "PROGRAM L" fullword ascii
		$s18 = "GPRTMAX" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_25 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
		id = "8b2f2ba2-e9cc-5b3c-8af9-4217d662bc3f"
	strings:
		$s1 = "C:\\WINDOWS" fullword ascii
		$s2 = "aragua" fullword ascii
		$s4 = "\\driver32\\7$" ascii
		$s8 = "System V" fullword ascii
		$s9 = "Compu~r" fullword ascii
		$s10 = "PROGRAM L" fullword ascii
		$s18 = "GPRTMAX" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_26
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "forcegue" fullword ascii
		$s3 = "Windows\\Cur" fullword ascii
		$s4 = "System Id" fullword ascii
		$s5 = "Software\\Mic" fullword ascii
		$s6 = "utiBy0ToWideCh&$a" fullword ascii
		$s10 = "ModuleH" fullword ascii
		$s15 = "PeekNamed6G" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_26 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "e[PII_REDACTED]7bf68cb0c479638c9cd99a48e846d"
		id = "aa80a142-c8fc-504e-b475-e9838607bec6"
	strings:
		$s1 = "forcegue" fullword ascii
		$s3 = "Windows\\Cur" fullword ascii
		$s4 = "System Id" fullword ascii
		$s5 = "Software\\Mic" fullword ascii
		$s6 = "utiBy0ToWideCh&$a" fullword ascii
		$s10 = "ModuleH" fullword ascii
		$s15 = "PeekNamed6G" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_D
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Windows Security Service Feedback" fullword wide
		$s1 = "wssfmgr.exe" fullword wide
		$s2 = "\\rb.htm" ascii
		$s3 = "rb.htm" fullword ascii
		$s4 = "cook5" ascii
		$s5 = "5, 4, 2600, 0" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_D {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "35dfb55f419f476a54241f46e624a1a4"
		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
		hash3 = "597805832d45d522c4882f21db800ecf"
		hash4 = "6bd422d56e85024e67cc12207e330984"
		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
		hash6 = "b79d87ff6de654130da95c73f66c15fa"
		id = "9b8d8a60-a357-5cfd-8ff1-6264144ad7be"
	strings:
		$s0 = "Windows Security Service Feedback" fullword wide
		$s1 = "wssfmgr.exe" fullword wide
		$s2 = "\\rb.htm" ascii
		$s3 = "rb.htm" fullword ascii
		$s4 = "cook5" ascii
		$s5 = "5, 4, 2600, 0" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_27
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Mozilla/4.0" fullword ascii
		$s1 = "dizhi.gif" fullword ascii
		$s5 = "oftHaveAck+" ascii
		$s10 = "HlobalAl" fullword ascii
		$s13 = "$NtRND1$" fullword ascii
		$s14 = "_NStartup" ascii
		$s16 = "GXSYSTEM" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_27 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
		id = "22815745-086f-59ee-aac1-f35e49aa5835"
	strings:
		$s0 = "Mozilla/4.0" fullword ascii
		$s1 = "dizhi.gif" fullword ascii
		$s5 = "oftHaveAck+" ascii
		$s10 = "HlobalAl" fullword ascii
		$s13 = "$NtRND1$" fullword ascii
		$s14 = "_NStartup" ascii
		$s16 = "GXSYSTEM" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_28
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "www.flyeagles.com" fullword ascii
		$s1 = "iexplore.exe" fullword ascii
		$s2 = "www.km-nyc.com" fullword ascii
		$s3 = "cmdLine.exe" fullword ascii
		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
		$s5 = "/dizhi.gif" ascii
		$s6 = "/connect.gif" ascii
		$s7 = "USBTest.sys" fullword ascii
		$s8 = "/ver.htm" fullword ascii
		$s11 = "\\netscv.exe" ascii
		$s12 = "/app.htm" fullword ascii
		$s13 = "\\netsvc.exe" ascii
		$s14 = "/exe.htm" fullword ascii
		$s18 = "MicrosoftHaveAck" fullword ascii
		$s19 = "MicrosoftHaveExit" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and 7 of them

Full rule:
rule APT30_Sample_28 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
		hash2 = "5b590798da581c894d8a87964763aa8b"
		id = "1bc8c68f-ebbb-58b1-92aa[PII_REDACTED]a0"
	strings:
		$s0 = "www.flyeagles.com" fullword ascii
		$s1 = "iexplore.exe" fullword ascii
		$s2 = "www.km-nyc.com" fullword ascii
		$s3 = "cmdLine.exe" fullword ascii
		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
		$s5 = "/dizhi.gif" ascii
		$s6 = "/connect.gif" ascii
		$s7 = "USBTest.sys" fullword ascii
		$s8 = "/ver.htm" fullword ascii
		$s11 = "\\netscv.exe" ascii
		$s12 = "/app.htm" fullword ascii
		$s13 = "\\netsvc.exe" ascii
		$s14 = "/exe.htm" fullword ascii
		$s18 = "MicrosoftHaveAck" fullword ascii
		$s19 = "MicrosoftHaveExit" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and 7 of them
}
YARA Detection Rule: APT30_Sample_29
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "LSSAS.exe" fullword ascii
		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
		$s2 = ".petite" fullword ascii
		$s3 = "MicrosoftFlashExit" fullword ascii
		$s4 = "MicrosoftFlashHaveExit" fullword ascii
		$s5 = "MicrosoftFlashHaveAck" fullword ascii
		$s6 = "\\driver32" ascii
		$s7 = "MicrosoftFlashZJ" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_29 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "44492c53715d7c[PII_REDACTED]3843a321491cb23a"
		id = "24334885-fcb4-5a13-82e8-c8465f97361e"
	strings:
		$s0 = "LSSAS.exe" fullword ascii
		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
		$s2 = ".petite" fullword ascii
		$s3 = "MicrosoftFlashExit" fullword ascii
		$s4 = "MicrosoftFlashHaveExit" fullword ascii
		$s5 = "MicrosoftFlashHaveAck" fullword ascii
		$s6 = "\\driver32" ascii
		$s7 = "MicrosoftFlashZJ" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_30
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "5.1.2600.2180 (xpsp_sp2_rtm[PII_REDACTED])" fullword wide
		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
		$s5 = "ZRLDownloadToFileA" fullword ascii
		$s9 = "5.1.2600.2180" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_30 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
		id = "787b288a-6fb4-5483-af76-933651ec6d58"
	strings:
		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm[PII_REDACTED])" fullword wide
		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
		$s5 = "ZRLDownloadToFileA" fullword ascii
		$s9 = "5.1.2600.2180" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}