Essential information

Value / Name

b5be237e979ba5cef73f8ccd39b58c76236e6b52

Confidence

100/100

Revoked

Yes

Valid from

22/07/2022 14:00

Valid until

25/10/2023 14:00

Pattern type

yara

Published

20/12/2025 21:44

Modified

20/12/2025 21:44

Author / Source

AlienVault

Description

Pattern

rule MTI_Hunt_APT_Modified_MICROBACKDOOR_Strings    
   {    
    meta:   description = "Detects strings found in modified MICROBACKDOOR samples with screenshot capability"    
     disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"  strings:    
      $a = "ERROR: Unknown command"    
      $b = "ProxyServer"    
      $c = "screenshot"    
      $d = "uninst"    
      $e = "shell"    
      $f = "client.dll"    
      $g = "Timeout occured"    
    condition:    
      all of them    
   }

Labels / Tags

Labels: apt geopolitical conflict ghostwriter ukraine unc1151 unc2589

Marking (TLP)

TLP:CLEAR