ReversingLabs unknown stable yara

Linux_Backdoor_BPFDoor [backdoor]

Yara rule that detects BPFDoor backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            (
                (
                    all of ($packet_loop_v1_p*)
                ) and
                (
                    all of ($reverse_shell_v1_p*)
                ) and
                (
                    all of ($set_process_name_v1_p*)
                )
            ) or
            (
                (
                    all of ($packet_loop_v2_p*)
                ) and
                (
                    all of ($reverse_shell_v2_p*)
                ) and
                (
                    all of ($set_process_name_v2_p*)
                )
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...