Essential information

Value / Name

866e4689e038249e784934c43e06aad961c1f6d1

Confidence

100/100

Revoked

Yes

Valid from

03/10/2022 14:46

Valid until

06/01/2024 13:46

Pattern type

yara

Published

20/12/2025 19:35

Modified

20/12/2025 22:03

Author / Source

AlienVault

Description

Pattern

rule M_APT_VIRTUALPITA_3   
   {   
    meta:   
    author = "Mandiant"   
    md5 = "fe34b7c071d96dac498b72a4a07cb246"   
    description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."   
    strings:   
    $x = {4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8}   
    condition:   
    uint32(0) == 0x464c457f and all of them     
   }

Labels / Tags

Labels: esxi vibs virtualpie virtualpita vmware vmware esxi

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.