Essential information

Value / Name

5e930d9f5b2b8943f02206a15efa9b9491cee995

Confidence

100/100

Revoked

Yes

Valid from

09/11/2023 15:13

Valid until

11/02/2025 15:13

Pattern type

yara

Published

20/12/2025 19:41

Modified

21/12/2025 01:49

Author / Source

AlienVault

Description

Pattern

rule M_Hunting_VBS_Batch_Launcher_Strings   
   {   
     meta:   
        author = "Mandiant"   
        date = "2023-02-13"   
        description = "Searching for VBS files used to launch a batch script."   
        disclaimer = "This rule is for hunting purposes only and has not been tested to run in a production environment."   
      strings:   
        $s1 = "CreateObject(\"WScript.Shell\")" ascii   
        $s2 = "WshShell.Run chr(34) &" ascii   
        $s3 = "& Chr(34), 0" ascii   
        $s4 = "Set WshShell = Nothing" ascii   
        $s5 = ".bat" ascii   
     condition:   
        filesize < 400 and   
        all of them   
   }

Labels / Tags

Labels: caddywiper gogetter microscada partyticket powershell russia sandworm scil ukraine variant wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.