ReversingLabs unknown stable yara
Linux_Backdoor_ChaosRAT [backdoor]
Yara rule that detects ChaosRAT backdoor.
Detection Logic
uint32(0) == 0x464C457F and
(
(
(
$network_communication_v1
) and
(
$send_system_information_v1
) and
(
all of ($download_file_v1_p*)
)
) or
(
(
$network_communication_v2
) and
(
all of ($download_file_v2_p*)
) and
(
$send_system_information_v2
)
) or
(
(
$network_communication_v3
) and
(
$get_mac_address_v3
) and
(
all of ($download_file_v3_p*)
)
)
) Field Validations
Loading…
Comments (0)
Loading comments...