ReversingLabs unknown stable yara

Linux_Backdoor_NoodRAT [backdoor]

Yara rule that detects NoodRAT backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            (
                all of ($change_name_on_system_p*)
            ) and
            (
                all of ($decrypt_configuration_p*)
            ) and
            (
                $encrypt_and_send_data
            ) and
            (
                $receive_and_decrypt_data
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...