Essential information

Value / Name

9bc3e902c4a5875f21a59d9b932584a2e37953bb

Confidence

100/100

Revoked

Yes

Valid from

02/02/2024 12:49

Valid until

07/05/2025 13:49

Pattern type

yara

Published

20/12/2025 19:42

Modified

21/12/2025 03:06

Author / Source

AlienVault

Description

Pattern

rule masepie_campaign_webdavlnk   
   {   
       meta:   
           description = "Detect Malicious LNK from CERT-UA#8399"   
           references = "TRR240101;https://cert.gov.ua/article/6276894"   
           hash = "19d0c55ac466e4188c4370e204808ca0bc02bba480ec641da8190cb8aee92bdc"   
           date = "2024-01-24"   
           author = "HarfangLab"   
           context = "file"   
       strings:   
           $a1 = "[system.Diagnostics.Process]::Start('msedge','http" wide nocase fullword   
           $a2 = "\\Microsoft\\Edge\\Application\\msedge.exe" wide nocase fullword   
           $a3 = "powershell.exe" ascii wide fullword   
           $s1 = "win-j5ggokh35ap" ascii fullword   
           $s2 = "desktop-q0f4sik" ascii fullword   
       condition:   
           filesize > 1200 and filesize < 5KB   
           and (uint16be(0) == 0x4c00)   
           and (   
               (all of ($a*))   
               or (any of ($s*))   
           )   
   }

Labels / Tags

Labels: apt28 fancy bear sofacy

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.