YARA · Costin Raiu yararules
CRAIU_Crime_Noabot
Noabot is a clone of Mirai
- Author
- Costin G. Raiu, Art of Noh, craiu@noh.ro
- Date
- 2024-01-11
- Score / Quality
- 75 / 85
What this rule detects
Noabot is a clone of Mirai
Associated malware family: Mirai.
Targets: Linux ELF.
It defines 13 patterns (10 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
crime-noabot.yarGNU General Public License v3.0
rule CRAIU_Crime_Noabot : FILE
{
meta:
= "Noabot is a clone of Mirai"
= "Costin G. Raiu, Art of Noh, craiu@noh.ro"
= "8626783b-898c-587d-9b23-c8c9111cde66"
= "2024-01-11"
= "2024-01-11"
= "https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining"
= "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_noabot.yara#L2-L57"
= "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
= "1603202a9115b83224233697f2ca1d36fef60113b94a73a15afed79a459aacc3"
= "16a28951acfe78b81046bfedb0b489efb4c9d3d1d3b8475c39b93cd5105dc866"
= "3da983ef3580a4b1b3b041cd991019b900f7995791c0acb32035ac5706085a63"
= "648a4f33b2c268523378929179af529bc064538326a1202dcdfcd9ee12ae8f6c"
= "829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890"
= "c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800"
= "c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e"
= "51c63f45f891ee80c5e8428575f12cb5881665cb9fe26018d173335db0f02012"
= 75
= 85
= "FILE"
= "1.1"
strings:
$a1a = "(crontab -l; printf '@reboot %s noa"
$a1b = "(crontab -l; printf '@reboot %s \"%s\" noa"
$a2 = {40 6D 61 67 69 63 40 [1-8] 6E 6F 61 [1-8] 0A 0A 49 20 61 69 6E 74 20 79 6F 75 72 20 61 76}
$a3 = {31 32 33 34 35 36 [1-8] 41 64 6D 69 6E 21 40 23 [1-8] 7A 68 61 6E 67 6A 69 65 31 32 33 [1-8] 43 75 6D 75 6C 75 73 4C 69 6E 75 78 21 [1-8] 61 62 63 31 32 33 24 [1-8] 77 65 62 40 31 32 33 [1-8] 6D 70 69 75 73 65 72 [1-8] 61 74 75 61 6C 69 7A 61}
$a4 = "HACKED: %s:%d:%s:%s"
$a5 = {25 64 7C 25 64 00 31 76 57 3F 3E 55 00 26 25 2423 00 67 76 64 64 60 78 65 73 00 00 26 25 24 00}
$b1 = "ufw allow 24816"
$b2 = "iptables -I INPUT -p tcp --dport 24816 -j ACCEPT"
$b3 = "iptables -I OUTPUT -p tcp --dport 24816 -j ACCEPT"
$b4 = "firewall-cmd --permanent --add-port 24816/tcp"
$b5 = "magicPussyMommy"
$c1 = "SOCKET_CREATING_ERROR SCANNER"
$c2 = "SOCKET_CREATING_ERROR RECYCLE"
condition:
filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) )
}
Strings (13 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $a1a | text | "(crontab -l; printf '@reboot %s noa" | |
| $a1b | text | "(crontab -l; printf '@reboot %s \"%s\" noa" | |
| $a2 | hex | {40 6D 61 67 69 63 40 [1-8] 6E 6F 61 [1-8] 0A 0A 49 20 61 69 6E 74 20 79 6F 75 72 20 61 76} | |
| $a3 | hex | {31 32 33 34 35 36 [1-8] 41 64 6D 69 6E 21 40 23 [1-8] 7A 68 61 6E 67 6A 69 65 31 32 33 [1-8] 43 75 6D 75 6C 75 73 4C 69 6E 75 78 21 [1-8] 61 62 63 31 32 33 24 … | |
| $a4 | text | "HACKED: %s:%d:%s:%s" | |
| $a5 | hex | {25 64 7C 25 64 00 31 76 57 3F 3E 55 00 26 25 2423 00 67 76 64 64 60 78 65 73 00 00 26 25 24 00} | |
| $b1 | text | "ufw allow 24816" | |
| $b2 | text | "iptables -I INPUT -p tcp --dport 24816 -j ACCEPT" | |
| $b3 | text | "iptables -I OUTPUT -p tcp --dport 24816 -j ACCEPT" | |
| $b4 | text | "firewall-cmd --permanent --add-port 24816/tcp" | |
| $b5 | text | "magicPussyMommy" | |
| $c1 | text | "SOCKET_CREATING_ERROR SCANNER" | |
| $c2 | text | "SOCKET_CREATING_ERROR RECYCLE" |
Condition
filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) )In plain words (Heuristic)
- The file must start with the ELF header — a Linux/Unix executable.
- The file must be smaller than 10MB (a cheap guard that skips large files).
- All patterns in ( $b* ) must match.
- All patterns in ( $c* ) must match.
- At least one pattern in ( $a* ) must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 1603202a9115b83224233697f2ca1d36fef60113b94a73a15afed79a459aacc3
- 16a28951acfe78b81046bfedb0b489efb4c9d3d1d3b8475c39b93cd5105dc866
- 3da983ef3580a4b1b3b041cd991019b900f7995791c0acb32035ac5706085a63
- 648a4f33b2c268523378929179af529bc064538326a1202dcdfcd9ee12ae8f6c
- 829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890
- c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800
- c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e
Licence & attribution
Author: Costin G. Raiu, Art of Noh, craiu@noh.ro
Source repository: Costin Raiu yararules @ 23cf0ca220
Licence: GNU General Public License v3.0 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 8626783b-898c-587d-9b23-c8c9111cde66
Metadata
| version | 1.1 |
|---|
Tags:FILE
Related rules
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareSignature Base (Florian Roth / Nextron)· Mehmet Ali Kerimoglu a.k.a. CYB3RMX· 2022-03-16
- MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-03-30
- MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-03-30
- GenericCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-07-19
- Suspicious / huntingCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2023-12-28