Essential information

Value / Name

279894bfac377da9b958fe7159a03b7e117b5e01

Confidence

100/100

Revoked

Yes

Valid from

02/02/2024 12:49

Valid until

07/05/2025 13:49

Pattern type

yara

Published

20/12/2025 19:42

Modified

21/12/2025 03:06

Author / Source

AlienVault

Description

No description.

Pattern

rule masepie_campaign_masepie   
   {   
       meta:   
           description = "Detect MASEPIE from CERT-UA#8399"   
           references = "TRR240101;https://cert.gov.ua/article/6276894"   
           hash = "18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6"   
           date = "2024-01-24"   
           author = "HarfangLab"   
           context = "file"   
       strings:   
           $t1 = "Try it againg" ascii wide fullword   
           $t2 = "{user}{SEPARATOR}{k}" ascii wide fullword   
           $t3 = "Error transporting file" ascii wide fullword   
           $t4 = "check-ok" ascii wide fullword   
           $a1 = ".join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))" ascii wide fullword   
           $a2 = "dec_file_mes(mes, key)" ascii wide fullword   
           $a3 = "os.popen('whoami').read()" ascii wide fullword   
       condition:   
           filesize > 2KB and filesize < 15MB   
           and (4 of them)   
   }

Labels / Tags

Labels: apt28 fancy bear sofacy

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.