Essential information

Value / Name

9a24bf79f5ed726c37a5a45150a813f4aa36bd98

Confidence

100/100

Revoked

Yes

Valid from

05/08/2022 12:18

Valid until

08/11/2023 11:18

Pattern type

yara

Published

20/12/2025 19:34

Modified

20/12/2025 21:33

Author / Source

AlienVault

Description

Pattern

rule M_Disrupt_ROADSWEEP_1   
      
   {   
      
       meta:   
      
           author = "Mandiant"   
      
           description = "Identifies the encryption key used within ROADSWEEP"   
      
      
      
       strings:   
      
           $ = {C6 45 D5 E4 C6 45 D6 B1 C6 45 D7 6B C6 45 D8 22 C6 45 D9 B5 C6 45 DA 88 C6 45 DB 94 C6 45 DC AA C6 45 DD 86 C6 45 DE C4 C6 45 DF 21 C6 45 E0 E8 C6 45 E1 75 C6 45 E2 9D C6 45 E3 F3 C7 44 24 10 00 00 00 F0}   
      
      
      
       condition:   
      
           all of them   
      
   }

Labels / Tags

Labels: chimneysweep iran roadsweep telegram wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.