Essential information

Value / Name

ae76fcf9b0c7740ff2e7be88acd0d4354ac08ea0

Confidence

100/100

Revoked

Yes

Valid from

28/05/2024 13:28

Valid until

31/08/2025 13:28

Pattern type

yara

Published

21/12/2025 05:02

Modified

21/12/2025 05:02

Author / Source

AlienVault

Description

No description.

Pattern

rule PTESC_apt_multi_ZZ_DecoyDog__Trojan__FirstStage__v2{   
   	strings:   
   		$clefia_sbox = {57 49 D1 C6 2F 33 74 FB 95 6D 82 EA 0E B0 A8 1C}   
   		$linux = "machine-id"   
   		$windows1 = "\x00http\x00"   
   		$windows2 = "getaddrinfo"   
   		$windows3 = "VirtualProtect"   
   		$windows4 = "GetModuleFileNameA"   
   		$windows5 = "ReadFile"   
   	condition:   
   		( uint16be ( 0 ) == 0x4d5a and all of ( $windows* ) or uint32be ( 0 ) == 0x7F454C46 and $linux ) and $clefia_sbox and filesize < 100KB   
   }

Labels / Tags

Labels: apt operation lahat russia

Marking (TLP)

TLP:CLEAR