ReversingLabs unknown stable yara

Linux_Backdoor_ChaosRAT [backdoor]

Yara rule that detects ChaosRAT backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            (
                (
                    $network_communication_v1
                ) and
                (
                    $send_system_information_v1
                ) and
                (
                    all of ($download_file_v1_p*)
                )
            ) or
            (
                (
                    $network_communication_v2
                ) and
                (
                    all of ($download_file_v2_p*)
                ) and
                (
                    $send_system_information_v2
                )
            ) or
            (
                (
                    $network_communication_v3
                ) and
                (
                    $get_mac_address_v3
                ) and
                (
                    all of ($download_file_v3_p*)
                )
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...