ioc[.]one - OSINT Cyber Threat Intelligence Database

Shikata Ga Nai Encoder Still Going Strong | Mandiant

Tags

attack-pattern:

Data Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Tool - T1588.002

Show in Graph

Common Information

Type	Value
UUID	6504b756-23fc-466d-88cf-8ca309f01454
Fingerprint	a314896a89971f25
Analysis status	DONE
Considered CTI value	2
Text language
Published	Oct. 21, 2019, midnight
Added to db	Nov. 9, 2023, 12:24 a.m.
Last updated	Nov. 17, 2024, 6:54 p.m.
Headline	Shikata Ga Nai Encoder Still Going Strong
Title	Shikata Ga Nai Encoder Still Going Strong \| Mandiant
Detected Hints/Tags/Attributes	62/1/9

Source URLs

	Redirection	Url
Details	Source	https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html
Details	Source	https://www.mandiant.com/resources/blog/shikata-ga-nai-encoder-still-going-strong

URL Provider

Details	Provider	Source level domain
Details	fireeye.com	www.fireeye.com
Details	mandiant.com	www.mandiant.com

RSS Feed

Details	Id	Enabled	Feed title	Url	Added to db
Details	330	✔	Threat Intelligence	https://www.mandiant.com/resources/blog/rss.xml	2024-08-30 22:08

Attributes

Details	Type	#Events	CTI	Value
Details	File	1		iamnotbad.exe
Details	File	1		imnotbad.exe
Details	md5	1		def46c736a825c357918473e3c02b3ef
Details	IPv4	1		192.169.0.36
Details	Mandiant Uncategorized Groups	1		UNC902
Details	Threat Actor Identifier - APT	522		APT41
Details	Threat Actor Identifier - APT	13		APT20
Details	Threat Actor Identifier - FIN	73		FIN6
Details	Yara rule	1		rule Hunting_Rule_ShikataGaNai { meta: author = "Steven Miller" strings: $varInitializeAndXorCondition1_XorEAX = { B8 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 59 \| 5A \| 5B \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 40 \| 41 \| 42 \| 43 \| 45 \| 46 \| 47 ) ?? } $varInitializeAndXorCondition1_XorEBP = { BD ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 \| 59 \| 5A \| 5B \| 5C \| 5E \| 5F ) [0-50] 31 ( 68 \| 69 \| 6A \| 6B \| 6D \| 6E \| 6F ) ?? } $varInitializeAndXorCondition1_XorEBX = { BB ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 \| 59 \| 5A \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 58 \| 59 \| 5A \| 5B \| 5D \| 5E \| 5F ) ?? } $varInitializeAndXorCondition1_XorECX = { B9 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 \| 5A \| 5B \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 48 \| 49 \| 4A \| 4B \| 4D \| 4E \| 4F ) ?? } $varInitializeAndXorCondition1_XorEDI = { BF ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 \| 59 \| 5A \| 5B \| 5C \| 5D \| 5E ) [0-50] 31 ( 78 \| 79 \| 7A \| 7B \| 7D \| 7E \| 7F ) ?? } $varInitializeAndXorCondition1_XorEDX = { BA ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 \| 59 \| 5B \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 50 \| 51 \| 52 \| 53 \| 55 \| 56 \| 57 ) ?? } $varInitializeAndXorCondition2_XorEAX = { D9 74 24 F4 [0-30] B8 ?? ?? ?? ?? [0-10] ( 59 \| 5A \| 5B \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 40 \| 41 \| 42 \| 43 \| 45 \| 46 \| 47 ) ?? } $varInitializeAndXorCondition2_XorEBP = { D9 74 24 F4 [0-30] BD ?? ?? ?? ?? [0-10] ( 58 \| 59 \| 5A \| 5B \| 5C \| 5E \| 5F ) [0-50] 31 ( 68 \| 69 \| 6A \| 6B \| 6D \| 6E \| 6F ) ?? } $varInitializeAndXorCondition2_XorEBX = { D9 74 24 F4 [0-30] BB ?? ?? ?? ?? [0-10] ( 58 \| 59 \| 5A \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 58 \| 59 \| 5A \| 5B \| 5D \| 5E \| 5F ) ?? } $varInitializeAndXorCondition2_XorECX = { D9 74 24 F4 [0-30] B9 ?? ?? ?? ?? [0-10] ( 58 \| 5A \| 5B \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 48 \| 49 \| 4A \| 4B \| 4D \| 4E \| 4F ) ?? } $varInitializeAndXorCondition2_XorEDI = { D9 74 24 F4 [0-30] BF ?? ?? ?? ?? [0-10] ( 58 \| 59 \| 5A \| 5B \| 5C \| 5D \| 5E ) [0-50] 31 ( 78 \| 79 \| 7A \| 7B \| 7D \| 7E \| 7F ) ?? } $varInitializeAndXorCondition2_XorEDX = { D9 74 24 F4 [0-30] BA ?? ?? ?? ?? [0-10] ( 58 \| 59 \| 5B \| 5C \| 5D \| 5E \| 5F ) [0-50] 31 ( 50 \| 51 \| 52 \| 53 \| 55 \| 56 \| 57 ) ?? } condition: any of them }