YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1

Detects BPFDoor malware

APT / AkteurSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Kompiliert mit YARA-X

Autor: Florian Roth (Nextron Systems)
Datum: 2022-05-09
Geändert: 2023-12-05
Score / Qualität: 90 / 85

Was diese Regel erkennt

Detects BPFDoor malware

Sie definiert 6 Muster (0 Text, 6 Hex, 0 Regex).

Zusammenfassung aus den Metadaten und der Bedingung der Regel erzeugt.

Regelquelltext

.yar herunterladen

apt-mal-lnx-redmenshen-bpfdoor-controller-generic-may22-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 : FILE
{
	meta:
		description = "Detects BPFDoor malware"
		author = "Florian Roth (Nextron Systems)"
		id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"
		date = "2022-05-09"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L121-L156"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
		hash = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
		hash = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
		hash = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
		hash = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
		hash = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
		hash = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
		hash = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
		logic_hash = "57ae5f7dc1d202fe66d6626ef2bf2278b92bec0310449ce049bdaeaec5657c77"
		score = 90
		quality = 85
		tags = "FILE"

	strings:
		$op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
		$op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
		$op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
		$op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
		$op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
		$op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or 4 of them
}

Strings (6 Muster)

Bezeichner	Typ	Wert
$op1	Hex	{ c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
$op2	Hex	{ 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
$op3	Hex	{ 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
$op4	Hex	{ 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
$op5	Hex	{ 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
$op6	Hex	{ 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }

Bedingung

uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or 4 of them

In Worten (Heuristik)

Die Datei muss kleiner als 200KB sein (eine günstige Grenze, die große Dateien ausschließt).
Mindestens 2 Muster aus der Regel müssen treffen.
Mindestens 4 Muster aus der Regel müssen treffen.

Diese Regel im Browser testen

Legen Sie eine Datei ab, um sie mit dieser Regel und YARA-X als WebAssembly zu scannen. Nichts wird hochgeladen.

Datei hier ablegen oder klicken zum AuswählenLokal mit YARA-X gescannt. Dateien bis 200 MB.

Im Editor öffnen

Referenzen

https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Proben-Hashes

Hashes der Proben, die der Autor in den Metadaten der Regel nennt (in Ihrer Threat-Intelligence-Plattform nachschlagen).

07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d
1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d
591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78
599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683
5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9
5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3
76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925
93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c
96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc
c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276
c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c
f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72
f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27
fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73
fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a

Lizenz & Namensnennung

Autor: Florian Roth (Nextron Systems)

Quell-Repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Lizenz: Detection Rule License 1.1 (Repository-Lizenz)

Originalregel

Gespiegelt über YARA Forge 20260927, das Regelnamen mit der Quelle präfixiert und normalisierte Meta-Felder ergänzt.

Regel-ID: d30df2ae-7008-53c0-9a61-8346a9c9f465

Tags:FILE

SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / AkteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24