ReversingLabs unknown stable yara

Linux_Backdoor_Linodas [backdoor]

Yara rule that detects Linodas backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            (
                $persistence_mechanism_ubuntu
            ) and
            (
                all of ($network_communication_*)
            ) and
            (
                (
                    (
                        $change_timestamp_and_read_config_v11
                    ) and
                    (
                        $persistence_mechanism_redhat_v11
                    ) and
                    (
                        $generate_machine_id_v11
                    )
                ) or
                (
                    (
                        $persistence_mechanism_redhat_v7
                    ) and
                    (
                        $get_device_name_v7
                    ) and
                    (
                        $generate_machine_id_v7
                    )
                )
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...