IOC: 3171deb38315e301b9b5a3364075b26882d7dc34

216.73.216.36

Indicator (IOC)

yara Revoked AlienVault · Published 20/12/2025 19:38 · Modified 20/12/2025 23:34

Essential information

Value / Name: 3171deb38315e301b9b5a3364075b26882d7dc34
Confidence: 100/100
Revoked: Yes
Valid from: 14/03/2023 04:35
Valid until: 16/06/2024 05:35
Pattern type: yara
Published: 20/12/2025 19:38
Modified: 20/12/2025 23:34
Author / Source: AlienVault

Description

Detects string deobfuscation function in SIDESHOW, may also detect other variants of malware from the same actor

Pattern

rule M_APT_Backdoor_Win_SIDESHOW_1 {   
    meta:   
    author = "Mandiant"   
    description = "Detects string deobfuscation function in SIDESHOW, may also detect other variants of malware from the same actor"   
    strings:   
    $code1 = { 41 0F B6 ?? 33 ?? 48 ?? ?? 0F 1F 80 00 00 00 00 3A ?? 74 ?? FF ?? 48 FF ?? 83 ?? 48 72 ?? EB ?? 41 0F ?? ?? 2B ?? ?? 39 8E E3 38 83 ?? 48 F7 ?? C1 ?? 04 8D ?? ?? C1 ?? 03 2B ?? ?? 39 8E E3 38 }   
    condition:   
    uint16(0) == 0x5a4d and (all of them)   
   }

Labels / Tags

Labels: lidshift lidshot lightshift phish plankwalk sideshow temp.hermit tightvnc viewer touchshift unc2970 wordpress

Marking (TLP)

TLP:CLEAR