Essential information

Value / Name

46adb27b4e8823250cbd29f63b695079cccfd326

Confidence

100/100

Revoked

Yes

Valid from

09/11/2023 15:13

Valid until

11/02/2025 15:13

Pattern type

yara

Published

20/12/2025 19:41

Modified

21/12/2025 01:49

Author / Source

AlienVault

Description

Pattern

rule M_Hunting_GOGETTER_SystemdConfiguration_1   
   {   
     meta:   
        author = "Mandiant"   
        description = "Searching for Systemd Unit Configuration Files but with some known filenames observed with GOGETTER"   
        disclaimer = "This rule is for hunting purposes only and has not been tested to run in a production environment."   
      strings:   
        $a1 = "[Install]" ascii fullword   
        $a2 = "[Service]" ascii fullword   
        $a3 = "[Unit]" ascii fullword   
        $v1 = "Description=" ascii   
        $v2 = "ExecStart=" ascii   
        $v3 = "Restart=" ascii   
        $v4 = "RestartSec=" ascii   
        $v5 = "WantedBy=" ascii   
        $f1 = "fail2ban-settings" ascii fullword   
        $f2 = "system-sockets" ascii fullword   
        $f3 = "oratredb" ascii fullword   
        $f4 = "cloud-online" ascii fullword   
      condition:   
        filesize < 1MB and (3 of ($a*)) and (3 of ($v*)) and (1 of ($f*))   
   }

Labels / Tags

Labels: caddywiper gogetter microscada partyticket powershell russia sandworm scil ukraine variant wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.