Essential information

Value / Name

70237746c55ddb5e7d00602f1e9ba9872931fa67

Confidence

100/100

Revoked

Yes

Valid from

20/05/2022 10:48

Valid until

23/08/2023 10:48

Pattern type

yara

Published

20/12/2025 19:32

Modified

20/12/2025 19:47

Author / Source

AlienVault

Description

Pattern

rule apt_CN_TwistedPanda_droppers {   
      meta:   
         author = "Check Point Research"   
         description = "Detect droppers used by TwistedPanda"   
         date = "2022-04-14"   
         hash = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"   
         hash = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"   
         hash = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"   
            
      strings:   
        // 81 FA ?? ?? ?? ??                                   cmp     edx, 4BED1896h   
        // 75 ??                                               jnz     short loc_140001829   
        // E8 ?? ?? ?? ??                                      call    sub_1400019D0   
        // 48 89 05 ?? ?? ?? ??                                mov     cs:qword_14001ED38, rax   
        // E? ?? ?? ?? ??                                      jmp     loc_1400018DD   
         $switch_control = { 81 FA [4] 75 ?? E8 [4] 48 89 05 [4] E? }   
      
        // 41 0F ?? ??                                         movsx   edx, byte ptr [r9]   
        // 44 ?? ??                                            or      r8d, edx   
        // 41 ?? ?? 03                                         rol     r8d, 3   
        // 41 81 ?? ?? ?? ?? ??                                xor     r8d, 0EF112233h   
        // 41 ?? ??                                            mov     eax, r10d   
         $byte_manipulation = { 41 0F [2] 44 [2] 41 [2] 03 41 81 [5] 41 }   
      
        // %public%   
        $stack_strings_1 = { 25 00 70 00 }   
        $stack_strings_2 = { 75 00 62 00 }   
        $stack_strings_3 = { 6C 00 69 00 }   
        $stack_strings_4 = { 63 00 25 00 }   
      
      condition:   
         // MZ signature at offset 0 and ...   
         uint16(0) == 0x5A4D and   
              
         // ... PE signature at offset stored in MZ header at 0x3C   
         uint32(uint32(0x3C)) == 0x00004550 and    
         filesize < 3000KB  and #switch_control > 8 and all of ($stack_strings_*) and $byte_manipulation   
   }

Labels / Tags

Labels: hodur plugx spinner twisted panda

Marking (TLP)

TLP:CLEAR