ReversingLabs unknown stable yara
Linux_Trojan_ChinaZ [backdoor]
Yara rule that detects ChinaZ trojan.
Detection Logic
uint32(0) == 0x464C457F and
(
(
(
all of ($collect_system_information_32_p*)
) and
(
$send_system_info_32
) and
(
$parse_c2_commands_32
) and
(
all of ($dns_flood_32_p*)
)
) or
(
(
all of ($collect_system_information_64_p*)
) and
(
$send_system_info_64
) and
(
$parse_c2_commands_64
) and
(
all of ($dns_flood_64_p*)
)
)
) Field Validations
Loading…
Comments (0)
Loading comments...