Essential information

Value / Name

bee21f2ee8dc32ded744ae728fe499bbb0b23b07

Confidence

100/100

Revoked

Yes

Valid from

14/03/2023 04:35

Valid until

16/06/2024 05:35

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:34

Author / Source

AlienVault

Description

Pattern

rule M_APT_Loader_Win_LIDSHOT_1 {   
    meta:   
    author = "Mandiant"   
   description = "Detects LIDSHOT implant"   
   strings:   
   $code1 = { 4C 89 6D ?? 4C 89 6D ?? C7 45 ?? 01 23 45 67 C7 45 ?? 89 AB CD EF C7 45 ?? FE DC BA 98 C7 45 ?? 76 54 32 10 4C 89 6C 24 ?? 48 C7 45 ?? 0F 00 00 00 C6 44 24 ?? 00 }   
       $code2 = { B8 1F 85 EB 51 41 F7 E8 C1 FA 03 8B CA C1 E9 1F 03 D1 6B CA 19 }   
       $code3 = { C7 45 ?? 30 6B 4C 6C 66 C7 45 ?? 55 00 }    
    condition:   
    uint16(0) == 0x5a4d and all of them   
   }

Labels / Tags

Labels: lidshift lidshot lightshift phish plankwalk sideshow temp.hermit tightvnc viewer touchshift unc2970 wordpress

Marking (TLP)

TLP:CLEAR