Essential information

Value / Name

4fffbf6b9fe048512ff0d9ec06409958c0dc7bfd

Confidence

100/100

Revoked

Yes

Valid from

03/10/2022 14:46

Valid until

06/01/2024 13:46

Pattern type

yara

Published

20/12/2025 19:35

Modified

20/12/2025 22:03

Author / Source

AlienVault

Description

Pattern

rule M_APT_VIRTUALPITA_2   
   {   
    meta:   
    author = "Mandiant"   
    md5 = "fe34b7c071d96dac498b72a4a07cb246"   
    description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246. Opcodes from 401a36 to 401adc"   
    strings:   
    $x = {85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01}   
    condition:   
    uint32(0) == 0x464c457f and all of them     
   }

Labels / Tags

Labels: esxi vibs virtualpie virtualpita vmware vmware esxi

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.