216.73.216.36

Indicator (IOC)

yara Revoked AlienVault · Published 20/12/2025 19:38 · Modified 20/12/2025 23:34

Essential information

Value / Name
d619983ed9245f0ff93606c256561d6afe06e000
Confidence
100/100
Revoked
Yes
Valid from
14/03/2023 04:35
Valid until
16/06/2024 05:35
Pattern type
yara
Published
20/12/2025 19:38
Modified
20/12/2025 23:34
Author / Source
AlienVault

Description

Hunting rule For TOUCHKEY

Pattern

rule M_Hunting_TOUCHKEY {   
    meta:   
    author = "Mandiant"   
    description = "Hunting rule For TOUCHKEY"   
    strings:   
    $a1 = "Normal.dost"    
    $a2 = "Normal.docb"    
    $c1 = "[SELECT]" ascii wide   
    $c2 = "[SLEEP]" ascii wide   
    $c3 = "[LSHIFT]" ascii wide   
    $c4 = "[RSHIFT]" ascii wide   
    $c5 = "[ENTER]" ascii wide   
    $c6 = "[SPACE]" ascii wide   
    condition:   
    (uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550    
    and filesize < 200KB and (5 of ($c*)) and $a1 and $a2   
   }

Labels / Tags

Labels: lidshift lidshot lightshift phish plankwalk sideshow temp.hermit tightvnc viewer touchshift unc2970 wordpress

Marking (TLP)

TLP:CLEAR