← Back to SOC feed Coverage →

Threat Group 3390 APT Sample - HttpBrowser RAT Sample

yara CRITICAL Yara-Rules
aptbackdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-04T23:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential HttpBrowser RAT activity associated with Threat Group 3390, indicating possible remote code execution and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threat activity early in the attack lifecycle.

YARA Rule

rule HttpBrowser_RAT_Sample2  
{

    meta:
        description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 80
        hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
   
    strings:
        $s0 = "nKERNEL32.DLL" fullword wide
        $s1 = "WUSER32.DLL" fullword wide
        $s2 = "mscoree.dll" fullword wide
        $s3 = "VPDN_LU.exeUT" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 250KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_ThreatGroup3390.yar