Essential information

Value / Name

def7492fda3a3ac391aace5b25e238faffb739fd

Confidence

100/100

Revoked

Yes

Valid from

01/09/2023 15:01

Valid until

04/12/2024 14:01

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:06

Author / Source

AlienVault

Description

Pattern

rule netd_FileExtensionString {  meta:  author = "NCSC"  description = "File extension strings"  date = "2023-08-31"  strings:  $ = ".dat,.bak,.xml,.txt,.ovpn,.xml,wa.db,msgstore.db,.pdf,.xlsx,.csv,.zip,telephony.db,.png,.jpg,.jpeg,.kme,database.hik,database.hik-journal,ezvizlog.db,cache4.db,contacts2.db,.docx,.gz,.rar,.tar,.7zip,.zip,.kmz,locksettings.db,mmssms.db,telephony.db,signal.db,mmssms.db,profile.db,accounts.db,PyroMsg.DB,.exe,.kml"  condition:  uint32(0) == 0x464C457F and any of them }

Labels / Tags

Labels: android cisa infamous chisel ncsc sandworm

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.