ReversingLabs unknown stable yara

Linux_Backdoor_GTPDOOR [backdoor]

Yara rule that detects GTPDOOR backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            (
                (
                    all of ($send_result_to_peer_v1_p*)
                ) and
                (
                    $execute_remote_command_v1
                ) and
                (
                    all of ($send_reply_v1_p*)
                ) and
                (
                    $daemon_already_running_check_v1
                )
            ) or
            (
                (
                    all of ($send_result_to_peer_v2_p*)
                ) and
                (
                    $execute_remote_command_v2
                ) and
                (
                    all of ($main_routine_v2_p*)
                )
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...