deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WildNeutron_Sample_2
Repository: Yara-Rules/rules
Detects: Wild Neutron APT Sample Rule - file 8d80f9ef[PII_REDACTED]9f4b6070cb8fce18a008ae9dd8b[PII_REDACTED]654d13a6f
Author: Florian Roth
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
        $s1 = "IgfxUpt.exe" fullword wide /* score: '20.00' */
        $s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
        $s3 = "Intel(R) Common User Interface" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s11 = "Key Usage" fullword ascii /* score: '12.00' */
        $s12 = "Intel Integrated Graphics Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '12.00' */
        $s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and all of them

Full rule:
rule WildNeutron_Sample_2 
{

    meta:
        description = "Wild Neutron APT Sample Rule - file 8d80f9ef[PII_REDACTED]9f4b6070cb8fce18a008ae9dd8b[PII_REDACTED]654d13a6f"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
        date = "2015-07-10"
        score = 60
        hash = "8d80f9ef[PII_REDACTED]9f4b6070cb8fce18a008ae9dd8b[PII_REDACTED]654d13a6f"

    strings:
        $s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
        $s1 = "IgfxUpt.exe" fullword wide /* score: '20.00' */
        $s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
        $s3 = "Intel(R) Common User Interface" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s11 = "Key Usage" fullword ascii /* score: '12.00' */
        $s12 = "Intel Integrated Graphics Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '12.00' */
        $s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */

    condition:
        uint16(0) == 0x5a4d and filesize < 600KB and all of them
}
YARA Detection Rule: WildNeutron_Sample_3
Repository: Yara-Rules/rules
Detects: Wild Neutron APT Sample Rule - file c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0
Author: Florian Roth
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$x1 = "178.162.197.9" fullword ascii /* score: '9.00' */
        $x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
        $s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
        $s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
        $s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s5 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
        $s6 = "ECDSA with SHA256" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
        $s7 = "Acer LiveUpdater" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 2020KB and ( 1 of ($x*) or all of ($s*) )

Full rule:
rule WildNeutron_Sample_3 
{

    meta:
        description = "Wild Neutron APT Sample Rule - file c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
        date = "2015-07-10"
        score = 60
        hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
   
    strings:
        $x1 = "178.162.197.9" fullword ascii /* score: '9.00' */
        $x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
        $s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
        $s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
        $s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s5 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
        $s6 = "ECDSA with SHA256" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
        $s7 = "Acer LiveUpdater" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.00' */
    
    condition:
        uint16(0) == 0x5a4d and filesize < 2020KB and ( 1 of ($x*) or all of ($s*) )
}
YARA Detection Rule: WildNeutron_Sample_4
Repository: Yara-Rules/rules
Detects: Wild Neutron APT Sample Rule - file b[PII_REDACTED]bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45
Author: Florian Roth
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$x1 = "WinRAT-Win32-Release.exe" fullword ascii /* score: '22.00' */
        $s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
        $s1 = "RtlUpd.EXE" fullword wide /* score: '20.00' */
        $s2 = "RtlUpd.exe" fullword wide /* score: '20.00' */
        $s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
        $s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s6 = "Key Usage" fullword ascii /* score: '12.00' */
        $s7 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1240KB and all of them

Full rule:
rule WildNeutron_Sample_4 
{

    meta:
        description = "Wild Neutron APT Sample Rule - file b[PII_REDACTED]bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
        date = "2015-07-10"
        score = 60
        hash = "b[PII_REDACTED]bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"

    strings:
        $x1 = "WinRAT-Win32-Release.exe" fullword ascii /* score: '22.00' */
        $s0 = "rundll32.exe \"%s\",#1" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
        $s1 = "RtlUpd.EXE" fullword wide /* score: '20.00' */
        $s2 = "RtlUpd.exe" fullword wide /* score: '20.00' */
        $s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide /* PEStudio Blacklist: strings */ /* score: '16.00' */
        $s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s6 = "Key Usage" fullword ascii /* score: '12.00' */
        $s7 = "id-at-serialNumber" fullword ascii /* PEStudio Blacklist: strings */ /* score: '10.00' */
  
    condition:
        uint16(0) == 0x5a4d and filesize < 1240KB and all of them
}
YARA Detection Rule: WildNeutron_Sample_5
Repository: Yara-Rules/rules
Detects: Wild Neutron APT Sample Rule - file 1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206
Author: Florian Roth
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
        $s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
        $s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s4 = "sha-1WithRSAEncryption" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
        $s5 = "Postal code" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.00' */
        $s6 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
        $s7 = "Key Usage" fullword ascii /* score: '12.00' */
        $s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
        $s9 = "%02d.%04d.%s" fullword wide /* score: '7.02' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule WildNeutron_Sample_5 
{

    meta:
        description = "Wild Neutron APT Sample Rule - file 1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
        date = "2015-07-10"
        score = 60
        hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"

    strings:
        $s0 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
        $s1 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
        $s2 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
        $s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide /* score: '15.00' */
        $s4 = "sha-1WithRSAEncryption" fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
        $s5 = "Postal code" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.00' */
        $s6 = "id-ce-keyUsage" fullword ascii /* score: '12.00' */
        $s7 = "Key Usage" fullword ascii /* score: '12.00' */
        $s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii /* PEStudio Blacklist: strings */ /* score: '11.00' */
        $s9 = "%02d.%04d.%s" fullword wide /* score: '7.02' */

    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: WildNeutron_Sample_6
Repository: Yara-Rules/rules
Detects: Wild Neutron APT Sample Rule - file 4bd548fe07b19178281edb1ee81c9711525dab03dc0b[PII_REDACTED]c44cc75865
Author: Florian Roth
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$s0 = "mshtaex.exe" fullword wide /* score: '20.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 310KB and all of them

Full rule:
rule WildNeutron_Sample_6 
{

    meta:
        description = "Wild Neutron APT Sample Rule - file 4bd548fe07b19178281edb1ee81c9711525dab03dc0b[PII_REDACTED]c44cc75865"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
        date = "2015-07-10"
        score = 60
        hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b[PII_REDACTED]c44cc75865"

    strings:
        $s0 = "mshtaex.exe" fullword wide /* score: '20.00' */

    condition:
        uint16(0) == 0x5a4d and filesize < 310KB and all of them
}
YARA Detection Rule: WildNeutron_Sample_9
Repository: Yara-Rules/rules
Detects: Wild Neutron APT Sample Rule - file 781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e
Author: Florian Roth
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$s0 = "http://get.adobe.com/flashplayer/" fullword wide /* PEStudio Blacklist: strings */ /* score: '30.00' */
        $s1 = "xxxxxxxxxxxxxxxxxxxx" fullword wide /* reversed goodware string 'xxxxxxxxxxxxxxxxxxxx' */ /* score: '19.00' */
        $s4 = " Player Installer/Uninstaller" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.42' */
        $s5 = "Adobe Flash Plugin Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.00' */
        $s6 = "uSOFTWARE\\Adobe" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.42' */
        $s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
        $s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
        $s13 = "%d -> %d" fullword wide /* score: '7.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and all of them

Full rule:
rule WildNeutron_Sample_9 
{

    meta:
        description = "Wild Neutron APT Sample Rule - file 781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
        date = "2015-07-10"
        score = 60
        hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
 
    strings:
        $s0 = "http://get.adobe.com/flashplayer/" fullword wide /* PEStudio Blacklist: strings */ /* score: '30.00' */
        $s1 = "xxxxxxxxxxxxxxxxxxxx" fullword wide /* reversed goodware string 'xxxxxxxxxxxxxxxxxxxx' */ /* score: '19.00' */
        $s4 = " Player Installer/Uninstaller" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.42' */
        $s5 = "Adobe Flash Plugin Updater" fullword wide /* PEStudio Blacklist: strings */ /* score: '11.00' */
        $s6 = "uSOFTWARE\\Adobe" fullword wide /* PEStudio Blacklist: strings */ /* score: '10.42' */
        $s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
        $s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
        $s13 = "%d -> %d" fullword wide /* score: '7.00' */
 
    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and all of them
}
YARA Detection Rule: iexpl0reCode
Repository: Yara-Rules/rules
Detects: iexpl0re code features
Author: Seth Hardy

Pattern signatures:
$ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
        $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
        $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
        $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
        // 88h decrypt
        $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
        $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }

Detection condition:
any of them

Full rule:
rule iexpl0reCode : iexpl0ree Family 
{
    meta:
        description = "iexpl0re code features"
        author = "Seth Hardy"
        last_modified = "2014-07-21"
        
    strings:
        $ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 }
        $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 }
        $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 }
        $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 }
        // 88h decrypt
        $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
        $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 }
        
    condition:
        any of them
}
YARA Detection Rule: iexpl0reStrings
Repository: Yara-Rules/rules
Detects: Strings used by iexpl0re
Author: Seth Hardy

Pattern signatures:
$ = "%USERPROFILE%\\IEXPL0RE.EXE"
        $ = "\"<770j (("
        $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
        $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
        $ = "LoaderV5.dll"
        // stage 2
        $ = "POST /index%0.9d.asp HTTP/1.1"
        $ = "GET /search?n=%0.9d&"
        $ = "DUDE_AM_I_SHARP-3[PII_REDACTED]8979x6.626176"
        $ = "WHO_A_R_E_YOU?2.99792458x[PII_REDACTED]3592"
        $ = "BASTARD_&&_BITCHES_%0.8x"
        $ = "c:\\bbb\\eee.txt"

Detection condition:
any of them

Full rule:
rule iexpl0reStrings : iexpl0re Family
{
    meta:
        description = "Strings used by iexpl0re"
        author = "Seth Hardy"
        last_modified = "2014-07-21"
        
    strings:
        $ = "%USERPROFILE%\\IEXPL0RE.EXE"
        $ = "\"<770j (("
        $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK"
        $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE"
        $ = "LoaderV5.dll"
        // stage 2
        $ = "POST /index%0.9d.asp HTTP/1.1"
        $ = "GET /search?n=%0.9d&"
        $ = "DUDE_AM_I_SHARP-3[PII_REDACTED]8979x6.626176"
        $ = "WHO_A_R_E_YOU?2.99792458x[PII_REDACTED]3592"
        $ = "BASTARD_&&_BITCHES_%0.8x"
        $ = "c:\\bbb\\eee.txt"
        
    condition:
        any of them

}
YARA Detection Rule: iexpl0re
Repository: Yara-Rules/rules
Detects: iexpl0re family
Author: Seth Hardy

Detection condition:
iexpl0reCode or iexpl0reStrings

Full rule:
rule iexpl0re : Family
{
    meta:
        description = "iexpl0re family"
        author = "Seth Hardy"
        last_modified = "2014-07-21"
   
    condition:
        iexpl0reCode or iexpl0reStrings
        
}
YARA Detection Rule: HttpBrowser_RAT_Sample1
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "update.hancominc.com" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and $s0

Full rule:
rule HttpBrowser_RAT_Sample1 
{

    meta:
        description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 80
        hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
        hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
   
    strings:
        $s0 = "update.hancominc.com" fullword wide 
   
    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and $s0
}
YARA Detection Rule: HttpBrowser_RAT_Sample2
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Sample
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "nKERNEL32.DLL" fullword wide
        $s1 = "WUSER32.DLL" fullword wide
        $s2 = "mscoree.dll" fullword wide
        $s3 = "VPDN_LU.exeUT" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and all of them

Full rule:
rule HttpBrowser_RAT_Sample2  
{

    meta:
        description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 80
        hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa[PII_REDACTED]82a9983ae47b8992"
   
    strings:
        $s0 = "nKERNEL32.DLL" fullword wide
        $s1 = "WUSER32.DLL" fullword wide
        $s2 = "mscoree.dll" fullword wide
        $s3 = "VPDN_LU.exeUT" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 250KB and all of them
}
YARA Detection Rule: HttpBrowser_RAT_Gen
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Generic
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide 
        $s1 = "HttpBrowser/1.0" fullword wide
        $s2 = "set cmd : %s" ascii fullword
        $s3 = "\\config.ini" wide fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 45KB and filesize > 20KB and all of them

Full rule:
rule HttpBrowser_RAT_Gen 
{

    meta:
        description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 90
        hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
        hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
        hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
        hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
        hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
        hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
        hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
        hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
        hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
        hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
        hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
        hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
        hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
        hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
        hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
        hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
        hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
        hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
        hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
        hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
        hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"