CHIMNEYSWEEP
The MITRE Corporation
· Published 07/08/2024 22:03 · Modified 27/03/2026 01:05
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 07/08/2024 22:03
- Modified
- 27/03/2026 01:05
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 55 attack patterns (mitre), 1 sectors, 3 countries, 27 indicators, 1 campaign, 1 campaigns
Description
[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) is a backdoor malware that was deployed during [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) along with [ROADSWEEP](https://attack.mitre.org/software/S1150) ransomware, and has been used to target Farsi and Arabic speakers since at least 2012.(Citation: Mandiant ROADSWEEP August 2022)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (55)
-
T1070.006 usesTimestomp MITRE
-
T1553.002 usesCode Signing MITRE
-
T1569 usesSystem Services MITRE
-
T1027 usesObfuscated Files or Information MITRE
-
T1056 usesInput Capture MITRE
-
T1497 usesVirtualization/Sandbox Evasion MITRE
-
T1115 usesClipboard Data MITRE
-
T1113 usesScreen Capture MITRE
-
T1070 usesIndicator Removal MITRE
-
T1059 usesCommand and Scripting Interpreter MITRE
-
T1548.002 usesBypass User Account Control MITRE
-
T1218.003 usesCMSTP MITRE
Sectors (1)
-
Government targets
Countries (3)
-
Saudi Arabia targets
-
Bahrain targets
-
Albania targets
Indicators (27)
-
http://server-avira.com/cm.phpindicatesstix 100/100 Revoked· Valid until 21/09/2022 · Source: AlienVault -
stix 100/100 Revoked
stack_string SHA256 of 92c61e3047297136701c25deb658b35a
· Valid until 08/11/2023 · Source: AlienVault -
stix 100/100 Revoked
Win32:Dh-A\ [Heur] SHA256 of 49d72f9212d5653f5be9f764d8c9df24
· Valid until 08/11/2023 · Source: AlienVault -
stix 100/100 Revoked
stack_string SHA256 of 5d117d8ef075f3f8ed1d4edcc0771a2a0886a376
· Valid until 26/12/2023 · Source: AlienVault -
http://update-real.com/cm.phpindicatesstix 100/100 Revoked· Valid until 21/09/2022 · Source: AlienVault -
http://update-pgp.com/cm.phpindicatesstix 100/100 RevokedASCII text, with no line terminators 7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402
· Valid until 21/09/2022 · Source: AlienVault -
stix 100/100 Revoked
stack_strings SHA256 of 77a369e5e49e7e62d8eef2c00cd02950 SHA256 of 77a369e5e49e7e62d8eef2c00cd02950
· Valid until 08/11/2023 · Source: AlienVault
Campaign (1)
-
HomeLand Justice uses
Campaigns (1)
-
HomeLand Justice