Essential information

Value / Name

3afbb6767c5b39888b4ddf7bc459cc1fea223e2e

Confidence

100/100

Revoked

Yes

Valid from

01/09/2023 15:01

Valid until

04/12/2024 14:01

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:06

Author / Source

AlienVault

Description

Pattern

rule netd_CreatedFiles {  meta:  author = "NCSC"  description = "Unique file paths created by netd"  date = "2023-08-31"  strings:  $ = "/data/local/tmp/.aid.cache"  $ = "/data/local/tmp/.syscache.csv" $ = "/data/local/tmp/.syspackages.csv"  $ = "/data/local/tmp/.sysinfo.csv"  $ = "/data/local/tmp/.ndata.csv"  $ = "/data/local/tmp/.ndata.tmp"  $ = "/data/local/tmp/.android.cache.sh"  condition:  uint32(0) == 0x464C457F and any of them }

Labels / Tags

Labels: android cisa infamous chisel ncsc sandworm

Marking (TLP)

TLP:CLEAR