ReversingLabs unknown stable yara
Linux_Backdoor_Linodas [backdoor]
Yara rule that detects Linodas backdoor.
Detection Logic
uint32(0) == 0x464C457F and
(
(
$persistence_mechanism_ubuntu
) and
(
all of ($network_communication_*)
) and
(
(
(
$change_timestamp_and_read_config_v11
) and
(
$persistence_mechanism_redhat_v11
) and
(
$generate_machine_id_v11
)
) or
(
(
$persistence_mechanism_redhat_v7
) and
(
$get_device_name_v7
) and
(
$generate_machine_id_v7
)
)
)
) Field Validations
Loading…
Comments (0)
Loading comments...