Essential information

Value / Name

d08dcad45c456f2dbb7986c09eb1122441bd7918

Confidence

100/100

Revoked

Yes

Valid from

18/03/2023 19:10

Valid until

20/06/2024 20:10

Pattern type

yara

Published

20/12/2025 19:38

Modified

21/12/2025 00:08

Author / Source

AlienVault

Description

Pattern

rule apt_Reaper_MFC42_Loader {   
       meta:   
           id = "23a3eaff-2813-48a2-91c6-c5bc1c0873ac"   
           version = "1.0"   
           intrusion_set = "Reaper"   
           description = "Detects MFC42 loaders (Reaper)"   
           source = "SEKOIA.IO"   
           creation_date = "2023-03-09"   
           classification = "TLP:WHITE"   
       strings:   
           $ = {50 68 01 00 00 00 B8 4D 3C 2B 1A FF D0}   
       condition:   
           uint16be(0) == 0x4d5a   
           and filesize < 2MB    
           and all of them   
   }

Labels / Tags

Labels: ablygo apt backdoor chinotto chm espionage extremevnc mshta phishing powershell reaper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.