Essential information

Value / Name

7724cbae651cbd782aae247b4f91ef7982b34047

Confidence

100/100

Revoked

Yes

Valid from

14/03/2023 04:35

Valid until

16/06/2024 05:35

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:34

Author / Source

AlienVault

Description

Pattern

rule M_Code_LIGHTSHOW   
   {   
    meta:   
    author = "Mandiant"   
    description = "Hunting rule For LIGHTSHOW."   
    md5 = "ee5057da3e38b934dae15644c6eb24507fb5a187630c75725075b24a70065452"   
    strings:   
    $E01 = { 46 75 64 4d 6f 64 75 6c 65 2e 64 6c 6c }   
    $I01 = { 62 63 72 79 70 74 2e 64 6c 6c }   
    $I02 = { 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c }   
    $I03 = { 75 73 65 72 33 32 2e 64 6c 6c 00 }   
    $H1 = { 4D 5A 90 00 }   
    $H2 = { 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F }   
    $F01 = { 47 65 74 4d 6f 64 75 6c 65 46 69 6c 65 4e 61 6d 65 57 }   
    $F02 = { 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 }   
    $F03 = { 47 65 74 46 69 6c 65 54 79 70 65 }   
    $F04 = { 47 65 74 56 65 72 73 69 6f 6e }   
    $F05 = { 51 75 65 72 79 53 65 72 76 69 63 65 53 74 61 74 75 73 }   
    $F06 = { 42 43 72 79 70 74 4f 70 65 6e 41 6c 67 6f 72 69 74 68 6d 50 72 6f 76 69 64 65 72 }   
    $M01 = { 68 2d 79 6e b1 }   
    $M02 = { 68 ea 71 c2 55 }   
    $M03 = { 66 b8 ad eb }   
    $M04 = { 4c 8d 2c 6d b3 6c 05 39 }    
    $M05 = { 48 8d 2c 95 08 9d ec 9a }   
    $S01 = { 48 8d 0c f5 a3 cd 0a eb}   
    $S02 = { 81 f9 7f 56 e6 0a}   
    condition:   
    ($H1 in (0..2048)) and ($H2 in (0..2048)) and filesize < 100MB and filesize > 5KB and all of ($M0*) and all of ($E*) and all of ($I0*) and 6 of ($F0*) and all of ($S0*)   
   }

Labels / Tags

Labels: lidshift lidshot lightshift phish plankwalk sideshow temp.hermit tightvnc viewer touchshift unc2970 wordpress

Marking (TLP)

TLP:CLEAR