Signature Base unknown stable yara

apt_nix_elf_Derusbi_Linux_Strings [yara]

Detects Derusbi Backdoor ELF Strings

View Source

Detection Logic

uint32(0) == 0x464C457F and
      (
         (1 of ($a*) and 4 of ($b*) ) or
         (1 of ($a*) and 1 of ($c*)) or
         2 of ($a*) or
         all of ($b*)
      )

Field Validations

Loading…

Comments (0)

Loading comments...