Essential information

Value / Name

6d47541cf740a63ee905bad775acb7c83b0f0370

Confidence

100/100

Revoked

Yes

Valid from

05/08/2022 12:18

Valid until

08/11/2023 11:18

Pattern type

yara

Published

20/12/2025 19:34

Modified

20/12/2025 21:33

Author / Source

AlienVault

Description

Pattern

rule M_Disrupt_ZEROCLEAR_1 {    
      
       meta:    
      
           author = "Mandiant"    
      
           description = "Identifies code sequences in ZEROCLEAR"   
      
      
      
       strings:   
      
           $ = "B4B615C28CCD059CF8ED1ABF1C71FE03C0354522990AF63ADF3C911E2287A4B906D47D" wide   
      
           $ = "wp starts!"   
      
           $ = "un start!"   
      
           $ = "in start!"   
      
      
      
   condition:   
      
           all of them    
      
   }

Labels / Tags

Labels: chimneysweep iran roadsweep telegram wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.