ReversingLabs unknown stable yara

Linux_Backdoor_Krasue [backdoor]

Yara rule that detects Krasue backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            $switch_server
        ) and
        (
            $get_hostname
        ) and
        (
            all of ($start_server_p*)
        ) and
        (
            $send_encrypt
        ) and
        (
            $notify_server
        )

Field Validations

Loading…

Comments (0)

Loading comments...