YARA Detection Rule: ThreatGroup3390_C2
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT - C2 Server
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s1 = "api.apigmail.com"
        $s2 = "apigmail.com"
        $s3 = "backup.darkhero.org"
        $s4 = "bel.updatawindows.com"
        $s5 = "binary.update-onlines.org"
        $s6 = "blackcmd.com"
        $s7 = "castle.blackcmd.com"
        $s8 = "ctcb.blackcmd.com"
        $s9 = "darkhero.org"
        $s10 = "dav.local-test.com"
        $s11 = "test.local-test.com"
        $s12 = "dev.local-test.com"
        $s13 = "ocean.local-test.com"
        $s14 = "ga.blackcmd.com"
        $s15 = "helpdesk.blackcmd.com"
        $s16 = "helpdesk.csc-na.com"
        $s17 = "helpdesk.hotmail-onlines.com"
        $s18 = "helpdesk.lnip.org"
        $s19 = "hotmail-onlines.com"
        $s20 = "jobs.hotmail-onlines.com"
        $s21 = "justufogame.com"
        $s22 = "lnip.org"
        $s23 = "local-test.com"
        $s24 = "login.hansoftupdate.com"
        $s25 = "long.update-onlines.org"
        $s26 = "longlong.update-onlines.org"
        $s27 = "longshadow.dyndns.org"
        $s28 = "longshadow.up

Detection condition:
uint16(0) == 0x5a4d and 1 of them

Full rule:
rule ThreatGroup3390_C2
{

    meta:
        description = "Threat Group 3390 APT - C2 Server"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 60

    strings:
        $s1 = "api.apigmail.com"
        $s2 = "apigmail.com"
        $s3 = "backup.darkhero.org"
        $s4 = "bel.updatawindows.com"
        $s5 = "binary.update-onlines.org"
        $s6 = "blackcmd.com"
        $s7 = "castle.blackcmd.com"
        $s8 = "ctcb.blackcmd.com"
        $s9 = "darkhero.org"
        $s10 = "dav.local-test.com"
        $s11 = "test.local-test.com"
        $s12 = "dev.local-test.com"
        $s13 = "ocean.local-test.com"
        $s14 = "ga.blackcmd.com"
        $s15 = "helpdesk.blackcmd.com"
        $s16 = "helpdesk.csc-na.com"
        $s17 = "helpdesk.hotmail-onlines.com"
        $s18 = "helpdesk.lnip.org"
        $s19 = "hotmail-onlines.com"
        $s20 = "jobs.hotmail-onlines.com"
        $s21 = "justufogame.com"
        $s22 = "lnip.org"
        $s23 = "local-test.com"
        $s24 = "login.hansoftupdate.com"
        $s25 = "long.update-onlines.org"
        $s26 = "longlong.update-onlines.org"
        $s27 = "longshadow.dyndns.org"
        $s28 = "longshadow.update-onlines.org"
        $s29 = "longykcai.update-onlines.org"
        $s30 = "lostself.update-onlines.org"
        $s31 = "mac.navydocument.com"
        $s32 = "mail.csc-na.com"
        $s33 = "mantech.updatawindows.com"
        $s34 = "micr0soft.org"
        $s35 = "microsoft-outlook.org"
        $s36 = "mtc.navydocument.com"
        $s37 = "navydocument.com"
        $s38 = "mtc.update-onlines.org"
        $s39 = "news.hotmail-onlines.com"
        $s40 = "oac.3322.org"
        $s41 = "ocean.apigmail.com"
        $s42 = "pchomeserver.com"
        $s43 = "registre.organiccrap.com"
        $s44 = "security.pomsys.org"
        $s45 = "services.darkhero.org"
        $s46 = "sgl.updatawindows.com"
        $s47 = "shadow.update-onlines.org"
        $s48 =