YARA · Mandiant red team tool countermeasures

FIREEYE_RT_APT_Loader_Win_PGF_1

PDB string used in some PGF DLL samples

APT / threat actorMandiant red team tool countermeasuresBSD 2-Clause LicenseCompiles with YARA-X

Author: FireEye
Date: 2020-12-08
Modified: 2024-03-04
Score / Quality: 75 / 73

What this rule detects

PDB string used in some PGF DLL samples

Targets: Windows PE.

It defines 3 patterns (0 text, 0 hex, 3 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-loader-win-pgf-1.yarBSD 2-Clause License

rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE
{
	meta:
		description = "PDB string used in some PGF DLL samples"
		author = "FireEye"
		id = "14e2102c-3572-5314-999c-ff3f6c94de03"
		date = "2020-12-08"
		modified = "2024-03-04"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar#L4-L17"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "013c7708f1343d684e3571453261b586"
		logic_hash = "9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 6

	strings:
		$pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase
		$pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/ nocase
		$pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase

	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and any of them
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$pdb1	regex	/RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/	nocase
$pdb2	regex	/RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/	nocase
$pdb3	regex	/RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/	nocase

Condition

( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and any of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 15MB (a cheap guard that skips large files).
At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/mandiant/red_team_tool_countermeasures/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

013c7708f1343d684e3571453261b586

Licence & attribution

Author: FireEye

Source repository: Mandiant red team tool countermeasures @ 3561b71724

Licence: BSD 2-Clause License (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 14e2102c-3572-5314-999c-ff3f6c94de03

Metadata

rev	6

Tags:FILE

FIREEYE_RT_APT_Backdoor_Macos_GORAT_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-08
FIREEYE_RT_APT_Backdoor_Win_GORAT_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-08
FIREEYE_RT_APT_Backdoor_Win_GORAT_5
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Builder_PY_REDFLARE_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-11-27
FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Controller_Linux_REDFLARE_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-12-02
FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1
APT / threat actorMandiant red team tool countermeasures· FireEye· 2020-11-27