ReversingLabs unknown stable yara
Linux_Backdoor_BPFDoor [backdoor]
Yara rule that detects BPFDoor backdoor.
Detection Logic
uint32(0) == 0x464C457F and
(
(
(
all of ($packet_loop_v1_p*)
) and
(
all of ($reverse_shell_v1_p*)
) and
(
all of ($set_process_name_v1_p*)
)
) or
(
(
all of ($packet_loop_v2_p*)
) and
(
all of ($reverse_shell_v2_p*)
) and
(
all of ($set_process_name_v2_p*)
)
)
) Field Validations
Loading…
Comments (0)
Loading comments...