/*
  Rules generated from APT Report NetTraveler
  http://www.securelist.com/en/blog/8105/NetTraveler_is_Running_Red_Star_APT_Attacks_Compromise_High_Profile_Victims  
*/
rule APT_Malware_BAT_Contents { 
	meta: description = "APT Malware Batch File Contents" threat_level = 10 score = 60 
	strings: 
	$a1 = ">nul del"
	$a2 = "service.exe"
	$a3 = "service.dll"
	condition: all of them
}
rule APT_Malware_NetTraveler_Saker { 
	meta: description = "APT Malware NetTraveler Saker" threat_level = 10 score = 50 
	strings: 
	$a1 = "JustTempFun" fullword
	$a2 = "servicemain" nocase fullword
	condition: all of them
}
rule APT_Malware_NetTraveler_Trojan { 
	meta: description = "APT Malware NetTraveler Trojan" threat_level = 10 score = 65 
	strings: 
	$a1 = "Get From IEOption!"
	$a2 = "Get From Reg!"
	condition: all of them
}