Signature Base unknown stable yara

SUSP_LNX_ByteEncoder_Jan25 [yara]

Detects Linux binaries that encode bytes by splitting them into upper and lower nibbles and mapping them to custom lookup tables, seen being used by SEASPY and Bluez backdoors

View Source

Detection Logic

uint32be(0) == 0x7f454c46
      and filesize < 4MB
      and all of them

Field Validations

Loading…

Comments (0)

Loading comments...