Essential information

Value / Name

M_APT_Backdoor_NICECURL_datamine_module_1

Confidence

100/100

Revoked

Yes

Valid from

03/05/2024 12:24

Valid until

06/08/2025 12:24

Pattern type

yara

Published

20/12/2025 19:43

Modified

21/12/2025 03:58

Author / Source

AlienVault

Description

Pattern

rule M_APT_Backdoor_NICECURL_datamine_module_1 {
	meta:
		author = "Mandiant"
		md5 = "853687659483d215309941dae391a68f"
		date_created = "2024-01-18"
	    date_modified = "2024-01-18"
	    rev = "1"
	strings:
		$ = "a = \"llehS.tpircsW\"" ascii wide
		$ = "b = StrReverse(a)" ascii wide
		$ = "Set objShell = wscript.CreateObject(b)" ascii wide
		$ = "ModuleName & \" module started successfully.\"" ascii wide
		$ = "SendLog(MAC, Logs, ModuleName, \"Success\")" ascii wide
		$ = "& vbNewLine  & \"*** Ant:\"" ascii wide
		$ = "For Each antivirus in installedAntiviruses" ascii wide
		$ = "list=list & VBNewLine & antivirus.displayName" ascii wide
		$ = "checking the state of the 12th bit of productState property of the antivirus" ascii wide
		$ = "For Each item In query_result" ascii wide
		$ = "Set query_result = objWMI.ExecQuery(\"" ascii wide
		$ = "Function SendFile(FilePath, ModuleName)" ascii wide
		$ = "Function SendData(Base64Data, FolderName, FileName, Format)" 
ascii wide
		$ = "call HTTPPost(Url, sRequest)" ascii wide
		$ = "ChunckData = Mid(Base64Data, 1, lengthdata)" ascii wide
		$ = "ChunckData = Mid(Base64Data, (i * lengthdata) + 1)" ascii wide
		$ = "ChunckData = Mid(Base64Data, (i * lengthdata) + 1, lengthdata)" 
ascii wide
		$ = "Function SendLog(MAC, Logs, ModuleName, Status)" ascii wide
	condition:
		4 of them
}

Labels / Tags

Labels: apt cve-2021-44228 cyber espionage iran nicecurl tamecat

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.