Essential information

Value / Name

2733a8e3ab7de1f89fbf8412600b6ed837a2ea1f

Confidence

100/100

Revoked

Yes

Valid from

14/03/2023 04:35

Valid until

16/06/2024 05:35

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:34

Author / Source

AlienVault

Description

Pattern

rule M_Hunting_TOUCHSHOT {   
    meta:   
    author = "Mandiant"   
    description = "Hunting rule For TOUCHSHOT"   
    strings:   
    $path = "%s\\Microsoft\\Windows\\Themes\\" wide   
    $format = "%04d%02d%02d-%02d%02d%02d"   
    $s1 = "EnumDisplaySettingsExW" ascii   
    $s2 = "GetSystemMetrics" ascii   
    $s3 = "GetDC" ascii   
    $s5 = "ReleaseDC" ascii   
    condition:   
    (uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550   
    and filesize < 200KB and (3 of ($s*)) and $path and $format   
   }

Labels / Tags

Labels: lidshift lidshot lightshift phish plankwalk sideshow temp.hermit tightvnc viewer touchshift unc2970 wordpress

Marking (TLP)

TLP:CLEAR