Essential information

Value / Name

78e2262e21e076818697701fac9a2caad056702f

Confidence

100/100

Revoked

Yes

Valid from

22/09/2023 16:27

Valid until

25/12/2024 15:27

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:13

Author / Source

AlienVault

Description

Pattern

rule veeam_dumper {    
    meta:    
    description = "Detects Veeam credential Dumper"    
    author = "BlackBerry Threat Research Team"    
    date = "August 15, 2021"    
    license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"    
    strings:    
    $s1 = "SqlCommand" fullword ascii wide    
    $s2 = "SqlConnection" fullword ascii wide    
    $s3 = "SqlDataReader" fullword ascii wide    
    $s4 = "veeamp.exe" fullword ascii wide    
    $s5 = "veeamp.pdb" fullword ascii wide  condition:    
    uint16be(0) == 0x4d5a and filesize < 60KB    
    and 4 of them    
   }

Labels / Tags

Labels: conti dumper eazfuscator monti reverse engineering sql database veeambackup veeamp

Marking (TLP)

TLP:CLEAR