Zum Inhalt springen
yararules.org
Menü

YARA · Costin Raiu yararules

CRAIU_Unk_Liblzma_Encstrings

liblzma backdoor, encoded strings

MalwareCostin Raiu yararulesGNU General Public License v3.0Kompiliert mit YARA-X
Autor
Costin G. Raiu, Art of Noh, craiu@noh.ro
Datum
2024-03-30
Score / Qualität
75 / 85

Was diese Regel erkennt

liblzma backdoor, encoded strings

Sie definiert 3 Muster (1 Text, 2 Hex, 0 Regex).

Zusammenfassung aus den Metadaten und der Bedingung der Regel erzeugt.

Regelquelltext

.yar herunterladen
unk-liblzma-encstrings.yarGNU General Public License v3.0
rule CRAIU_Unk_Liblzma_Encstrings : FILE
{
	meta:
		description = "liblzma backdoor, encoded strings"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
		date = "2024-03-30"
		modified = "2024-03-30"
		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"

	strings:
		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 
              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00  
              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00 
              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00 
              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00  
              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
		$a3 = {
              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04  
              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00 
              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00  
              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00 
              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00 
              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }

	condition:
		( filesize < 15MB ) and ( any of them )
}

Strings (3 Muster)

BezeichnerTypWertModifikatoren
$a1Text"yolAbejyiejuvnup=Evjtgvsh5okmkAvj"ascii wide
$a2Hex{ 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 03 00 00 00 03 00 00 00 …
$a3Hex{ 33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06 E2 00 00 0 …

Bedingung

( filesize < 15MB ) and ( any of them )

In Worten (Heuristik)

  • Die Datei muss kleiner als 15MB sein (eine günstige Grenze, die große Dateien ausschließt).
  • Mindestens ein Muster aus der Regel muss treffen.

Diese Regel im Browser testen

Legen Sie eine Datei ab, um sie mit dieser Regel und YARA-X als WebAssembly zu scannen. Nichts wird hochgeladen.

Datei hier ablegen oder klicken zum AuswählenLokal mit YARA-X gescannt. Dateien bis 200 MB.

Im Editor öffnen

Referenzen

Lizenz & Namensnennung

Autor: Costin G. Raiu, Art of Noh, craiu@noh.ro

Quell-Repository: Costin Raiu yararules @ 23cf0ca220

Lizenz: GNU General Public License v3.0 (Repository-Lizenz)

Originalregel

Gespiegelt über YARA Forge 20260927, das Regelnamen mit der Quelle präfixiert und normalisierte Meta-Felder ergänzt.

Regel-ID: ca491b9c-400e-5f5e-9372-e403a095edba

Metadaten

version1.0

Tags:FILE

Verwandte Regeln

  • CRAIU_Crime_Noabot
    MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-01-11
  • CRAIU_Unk_Liblzma_Backdoor
    MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-03-30
  • CRAIU_Crashstrike
    GenerischCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-07-19
  • CRAIU_Susp_Ios_Shutdown
    Verdächtig / HuntingCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2023-12-28