Essential information

Value / Name

71d27fe64df4fdc82153f246f3f55c5ac0a16287

Confidence

100/100

Revoked

Yes

Valid from

14/03/2023 04:35

Valid until

16/06/2024 05:35

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:34

Author / Source

AlienVault

Description

Pattern

rule M_Hunt_APT_PLANKWALK_Code_String {    
    meta:   
    author = "Mandiant"   
    description = "Detects a format string containing code and token found in PLANKWALK"   
    strings:   
    $hex = { 63 6F 64 65 [1-6] 3D 25 64 26 [1-6] 75 73 65 72 [1-6] 3D 25 73 26 [1-6] 74 6F 6B 65 }   
    condition:    
    (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $hex   
   }

Labels / Tags

Labels: lidshift lidshot lightshift phish plankwalk sideshow temp.hermit tightvnc viewer touchshift unc2970 wordpress

Marking (TLP)

TLP:CLEAR