Indicator (IOC)
Essential information
- Value / Name
d1871e43c0a5ebc123eafa91b44ce00636ef02a3- Confidence
- 100/100
- Revoked
- Yes
- Valid from
- 01/09/2023 15:01
- Valid until
- 04/12/2024 14:01
- Pattern type
- yara
- Published
- 20/12/2025 19:40
- Modified
- 21/12/2025 01:06
- Author / Source
- AlienVault
Description
Tor configuration file strings in blob
Pattern
rule blob_TorCommandLine { meta: author = "NCSC" description = "Tor configuration file strings in blob" date = "2023-08-31" strings: $ = "SocksPort 127.0.0.1:1129" $ = "DataDirectory /data/local/prx/" $ = "/data/local/prx/hs/" $ = "HiddenServicePort 34371 127.0.0.1:34371" condition: uint32(0) == 0x464C457F and 2 of them }Labels / Tags
Marking (TLP)
TLP:CLEAR