Essential information

Value / Name

294a16e3d8f507cdcfaa4582b0f93427fe924ad8

Confidence

100/100

Revoked

Yes

Valid from

01/09/2023 15:01

Valid until

04/12/2024 14:01

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:06

Author / Source

AlienVault

Description

Pattern

rule ndbr_ScanStrings {  meta:  author = "NCSC"  description = "ndbr scan strings"  date = "2023-08-31"  strings:  $ = "INTERFACE = %s"  $ = "SOURCE = %s"  $ = "IP begin = %s"  $ = "IP end = %s"  $ = "PORT = top"  $ = "PORT begin = %hu"  $ = "PORT end = %hu"  $ = "PING %s"  $ = "SCAN %s"  $ = "*******start*scan********"  $ = "Host %s:"  condition:  uint32(0) == 0x464C457F and uint8(4) == 0x1 and uint16(18) == 0x0028 and all of them }

Labels / Tags

Labels: android cisa infamous chisel ncsc sandworm

Marking (TLP)

TLP:CLEAR