ReversingLabs unknown stable yara
Linux_Backdoor_GTPDOOR [backdoor]
Yara rule that detects GTPDOOR backdoor.
Detection Logic
uint32(0) == 0x464C457F and
(
(
(
all of ($send_result_to_peer_v1_p*)
) and
(
$execute_remote_command_v1
) and
(
all of ($send_reply_v1_p*)
) and
(
$daemon_already_running_check_v1
)
) or
(
(
all of ($send_result_to_peer_v2_p*)
) and
(
$execute_remote_command_v2
) and
(
all of ($main_routine_v2_p*)
)
)
) Field Validations
Loading…
Comments (0)
Loading comments...