Essential information

Value / Name

e25a8a21fffb5ae871022f4342db2a0e6561191e

Confidence

100/100

Revoked

Yes

Valid from

25/03/2024 13:29

Valid until

28/06/2025 14:29

Pattern type

yara

Published

20/12/2025 19:42

Modified

21/12/2025 03:24

Author / Source

AlienVault

Description

Pattern

rule M_APT_Downloader_WINELOADER_1   
   {   
   meta:   
   author = "Mandiant"   
   disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."   
   description = "Detects rc4 decryption logic in WINELOADER samples"   
    strings:   
   $ = {B9 00 01 00 00 99 F7 F9 8B 44 24 [50-200] 0F B6 00 3D FF 00 00 00} // Key initialization   
   $ = {0F B6 00 3D FF 00 00 00} // Key size   
    condition:   
   all of them   
    }

Labels / Tags

Labels: apt29 beatdrop burntbatter daveshell jsobfuscated rootsaw ukraine wineloader

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.