Essential information

Value / Name

1de20cc0e637ed72e4ade338639808c8909d5a14

Confidence

100/100

Revoked

Yes

Valid from

01/09/2023 15:01

Valid until

04/12/2024 14:01

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:06

Author / Source

AlienVault

Description

Pattern

rule db_androidpaths {  meta:  author = "NCSC"  description = "db Android path strings"  date = "2023-08-31"  strings:  $ = "/data/local/tmp/sessions.log.d/.ssh/remove_file.flag"  $ = "/data/local/tmp/sessions.log.d"  $ = "/data/local/tmp/sessions.log.d/.ssh"  $ = "/data/local/tmp/sessions.log.d/.ssh/authorized_keys"  $ = "/data/local/tmp/sessions.log.d/.ssh/know_host"  $ = "/data/local/tmp/sessions.log.d/dropbear_rsa_host_key"  $ = "/data/local/tmp/sessions.log.d/dropbear_dss_host_key"  $ = "/data/local/tmp/sessions.log.d/dropbear_ecdsa_host_key"  $ = "/data/local/tmp/sessions.log.d/session.key"  $ = "/data/local/tmp/sessions.log.d/.bash_history"  $ = "/data/local/tmp/sessions.log.d/dropbear_ed25519_host_key"  $ = "/data/local/tmp/sessions.log.d/"  $ = "/data/local/tmp/sessions.log.d"  condition:  uint32(0) == 0x464C457F and uint8(4) == 0x1 and uint16(18) == 0x0028 and all of them }

Labels / Tags

Labels: android cisa infamous chisel ncsc sandworm

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.