Rule Info
Name
Winnti_APT_Hdump_Tool
Author
Florian Roth
Description
Password dumper used by Winnti group - file pn.exe
Score
105
Reference
Internal Research
Date
2016-09-30
Minimum Yara
1.7
Rule Hash
bc0c5568d601860803b1c6de7ff561d7
Tags
['EXE', 'T1003', 'APT', 'G0044', 'FILE', 'CHINA']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
2
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR