Essential information

Value / Name

7f4fcffef605f9f65715c708a9fbbea4a60fb0a1

Confidence

100/100

Revoked

Yes

Valid from

18/11/2022 15:04

Valid until

21/02/2024 15:04

Pattern type

yara

Published

20/12/2025 19:36

Modified

20/12/2025 22:25

Author / Source

AlienVault

Description

No description.

Pattern

rule hz_rat_aes_packer   
   {   
    strings:   
       $decryption_body_747 = { 8D 44 24 1C 89 04 24 E8 84 ED 00 00 E8 DF DE 00 00 C7 44 24 08 10 00 00 00 C7 44 24 04 20 30 41 00 8D 44 24 54 89 04 24 C7 44 24 20 01 00 00 00 E8 B7 00 00 00 C7 84 24 3C 02 00 00 00 00 00 00 C7 84 24 38 02 00 00 00 00 00 00 EB 4B 8B 84 24 38 02 00 00 C1 E0 04 8D 90 40 30 41 00 8B 84 24 38 02 00 00 C1 E0 04 05 40 30 41 00 89 54 24 08 89 44 24 04 8D 44 24 54 89 04 24 C7 44 24 20 01 00 00 00 E8 E9 0E 00 00 83 84 24 3C 02 00 00 10 83 84 24 38 02 00 00 01 81 BC 24 3C 02 00 00 ?? ?? ?? 00 76 A8 B8 40 30 41 00 C7 44 24 20 01 00 00 00 FF D0 B8 00 00 00 00 89 44 24 18 EB 14 8B }   
       $decryption_body_748 = { 55 89 E5 5D C3 90 90 90 90 90 90 90 90 90 90 90 8D 4C 24 04 83 E4 F0 FF 71 FC 55 89 E5 57 56 53 51 81 EC 68 02 00 00 C7 85 CC FD FF FF 80 24 41 00 C7 85 D0 FD FF FF 3C 2B 41 00 8D 85 D4 FD FF FF 8D 4D E8 89 08 BA 28 17 40 00 89 50 04 89 60 08 8D 85 B4 FD FF FF 89 04 24 E8 51 EE 00 00 E8 AC DF 00 00 C7 44 24 08 10 00 00 00 C7 44 24 04 20 30 41 00 8D 85 F0 FD FF FF 89 04 24 C7 85 B8 FD FF FF 01 00 00 00 E8 78 01 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 EB 3F 8B 45 E0 C1 E0 04 8D 90 40 30 41 00 8B 45 E0 C1 E0 04 05 40 30 41 00 89 54 24 08 89 44 24 04 8D 85 F0 FD FF FF 89 04 24 C7 85 B8 FD FF FF 01 00 00 00 E8 B6 0F 00 00 83 45 E4 10 83 45 E0 01 81 7D E4 ?? ?? ?? 00 76 B8 A1 5C 71 45 00 C7 85 B8 FD FF FF 01 }   
    condition:   
       any of them   
   }

Labels / Tags

Labels: cobalt strike cve201711882 hz rat

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.