ReversingLabs unknown stable yara

Linux_Backdoor_PygmyGoat [backdoor]

Yara rule that detects PygmyGoat backdoor.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            $create_backdoor_socket
        ) and
        (
            all of ($backdoor_dataforward_p*)
        ) and
        (
            $main_constructor
        ) and
        (
            all of ($hook_accept_function_p*)
        )

Field Validations

Loading…

Comments (0)

Loading comments...