Essential information

Value / Name

M_APT_Downloader_TAMECAT_NICECURL_VBScript_1

Confidence

100/100

Revoked

Yes

Valid from

03/05/2024 12:24

Valid until

06/08/2025 12:24

Pattern type

yara

Published

20/12/2025 19:43

Modified

21/12/2025 03:58

Author / Source

AlienVault

Description

Pattern

rule M_APT_Downloader_TAMECAT_NICECURL_VBScript_1 {
    meta:
        author = "Mandiant"
        md5 = "d7bf138d1aa2b70d6204a2f3c3bc72a7"
        date_created = "2024-03-13"
        date_modified = "2024-03-13"
        rev = "1"
    strings:
        $ = "For Each antivirus in installedAntiviruses"
        $ = "list=list & VBNewLine & antivirus.displayName"
        $ = "\"conhost conhost powershell.exe -w 1 -c \""
        $ = "-UseBasicParsing).Content; &(gcm *e-e?p*)$"
        $ = "Set oE = objShell.Exec("
        $ = "\"cmd.exe /c set c=cu9rl --s9sl-no-rev9oke -s -d \""
        $ = "& call %c:9=% & set b=sta9rt"
    condition:
    3 of them
}

Labels / Tags

Labels: apt cve-2021-44228 cyber espionage iran nicecurl tamecat

Marking (TLP)

TLP:CLEAR