Essential information

Value / Name

6f43ef70dd53ad5b241c26c32aeb4c7bb95098d3

Confidence

100/100

Revoked

Yes

Valid from

05/08/2022 12:18

Valid until

08/11/2023 11:18

Pattern type

yara

Published

20/12/2025 19:34

Modified

20/12/2025 21:33

Author / Source

AlienVault

Description

Pattern

rule M_Backdoor_CHIMNEYSWEEP_1   
      
   {   
      
       meta:   
      
           author = "Mandiant"   
      
           description = "Detects strings found in CHIMNEYSWEEP"   
      
      
      
       strings:   
      
           $ = "%sAPPX.%x%x%x%x%x.tmp"   
      
           $ = "rerunadmn"   
      
           $ = "runupdate"   
      
           $ = "runupdateok"   
      
           $ = "baserun"   
      
           $ = "heyirunadmn"   
      
           $ = "subttoadmn"   
      
           $ = "ttrundll"   
      
           $ = "{\"ok\":false,"   
      
           $ = "TL_%s-%s"   
      
           $ = "|**|Net1NOFILE|**|"   
      
           $ = "%s:---:%s-%s:---:%s:---:www:---:MNEW"   
      
      
      
       condition:   
      
           uint16(0) == 0x5A4D and 8 of them   
      
   }

Labels / Tags

Labels: chimneysweep iran roadsweep telegram wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.