Essential information

Value / Name

ce7009366563991ec70afd5e20071b93527478c2

Confidence

100/100

Revoked

Yes

Valid from

05/08/2022 12:18

Valid until

08/11/2023 11:18

Pattern type

yara

Published

20/12/2025 19:34

Modified

20/12/2025 21:33

Author / Source

AlienVault

Description

Pattern

import "pe"
rule M_Backdoor_CHIMNEYSWEEP_2   
      
   {   
      
       meta:   
      
           author = "Mandiant"   
      
           description = "Detects encrypted data found in CHIMNEYSWEEP"   
      
      
      
       strings:   
      
           $key = {C6 45 D5 E4 C6 45 D6 B1 C6 45 D7 6B C6 45 D8 22 C6 45 D9 B5 C6 45 DA 88 C6 45 DB 94 C6 45 DC AA C6 45 DD 86 C6 45 DE C4 C6 45 DF 21 C6 45 E0 E8 C6 45 E1 75 C6 45 E2 9D C6 45 E3 F3 C7 44 24 10 00 00 00 F0}   
      
           $encoded_config = {FA c0 c7 e5}   
      
           $encoded_bot = {AE E0 ED D6}   
      
      
      
       condition:   
      
           uint16(0) == 0x5A4D and all of them and (pe.exports("RatingSetupUI") or pe.exports("A"))   
      
   }

Labels / Tags

Labels: chimneysweep iran roadsweep telegram wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.