ReversingLabs unknown stable yara

Linux_Trojan_ChinaZ [backdoor]

Yara rule that detects ChinaZ trojan.

View Source

Detection Logic

uint32(0) == 0x464C457F and
        (
            (
                (
                    all of ($collect_system_information_32_p*)
                ) and
                (
                    $send_system_info_32
                ) and
                (
                    $parse_c2_commands_32
                ) and
                (
                    all of ($dns_flood_32_p*)
                )
            ) or
            (
                (
                    all of ($collect_system_information_64_p*)
                ) and
                (
                    $send_system_info_64
                ) and
                (
                    $parse_c2_commands_64
                ) and
                (
                    all of ($dns_flood_64_p*)
                )
            )
        )

Field Validations

Loading…

Comments (0)

Loading comments...