Essential information

Value / Name

97622e7df34d1ca554e47154bf60df632fa9c301

Confidence

100/100

Revoked

Yes

Valid from

16/05/2023 16:05

Valid until

18/08/2024 16:05

Pattern type

yara

Published

20/12/2025 19:39

Modified

21/12/2025 00:33

Author / Source

AlienVault

Description

Pattern

rule apt_CN_CamaroDragon_sheel_strings {   
   	meta:   
   		author = "Itay Cohen @ Check Point Research"   
   		date = "2023-04-01"   
   		description = "Detects CamaroDragon's sheel tool."   
   		hash = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"   
   		reference = ""   
   	   
   	strings:   
   		$ = "write failed.open fail."   
   		$ = "open fail.%m"   
   		$ = "./sheel -h server_ip -p server_port -i update_index[0-4] [-r]"   
   		$ = "./sheel -h"   
   		$ = "update server list success!"   
   	   
   	condition:   
   		filesize < 12KB and   
   		3 of them   
   }

Labels / Tags

Labels: horse shell horseshell mips32 msb mirai mustang panda pakdoor panda sowat

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.