Essential information

Value / Name

7ab58f4fcc3b53095ffa84c3de49c04d0072045f

Confidence

100/100

Revoked

Yes

Valid from

01/09/2023 15:01

Valid until

04/12/2024 14:01

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:06

Author / Source

AlienVault

Description

Pattern

rule netd_ScrapedApps {  meta:  author = "NCSC"  description = "Application directories strings searched by netd"  date = "2023-08-31"  strings:  $ = "/data/data/com.android.providers.contacts"  $ = "/data/data/com.android.providers.telephony"  $ = "/data/data/com.google.android.gm"  $ = "/data/data/de.blinkt.openvpn"  $ = "/data/data/eu.thedarken.wldonate"  $ = "/data/data/net.openvpn.openvpn"  $ = "/data/data/org.telegram.messenger"  $ = "/data/data/org.thoughtcrime.securesms"  condition:  uint32(0) == 0x464C457F and all of them }

Labels / Tags

Labels: android cisa infamous chisel ncsc sandworm

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.