IMPLANT_5_v3

Description

XTunnel Implant by APT28

Query · yara

strings:
      $BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
      $BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }
   condition:
      any of them
Raw source IMPLANT_5_v3 · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule IMPLANT_5_v3 {
   meta:
      description = "XTunnel Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
      id = "0763e314-85d0-5c16-b766-36298176e0ff"
   strings:
      $BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
      $BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }
   condition:
      any of them
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.