Essential information

Value / Name

d61ff2430473f06fc42a1d452597c610027aace2

Confidence

100/100

Revoked

Yes

Valid from

25/03/2024 13:29

Valid until

28/06/2025 14:29

Pattern type

yara

Published

20/12/2025 19:42

Modified

21/12/2025 03:24

Author / Source

AlienVault

Description

Pattern

rule M_APT_Dropper_Rootsaw_Obfuscated   
   {   
   meta:   
   author = "Mandiant"   
   disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."   
   description = "Detects obfuscated ROOTSAW payloads"   
    strings:   
   $ = "function _"   
   $ = "new XMLHttpRequest();"   
   $ = "'\\x2e\\x7a\\x69\\x70'"   
   $ = "'\\x4f\\x70\\x65\\x6e'"   
   $ = "\\x43\\x3a\\x5c\\x57"   
    condition:   
   all of them   
   }

Labels / Tags

Labels: apt29 beatdrop burntbatter daveshell jsobfuscated rootsaw ukraine wineloader

Marking (TLP)

TLP:CLEAR