DITEKSHEN_MALWARE_Linux_Hiddenwasp

rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
{
	meta:
		description = "HiddenWasp backdoor payload"
		author = "ditekSHen"
		id = "220e5e6e-7c5c-5f70-b3eb-50d9c5ec636d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L461-L486"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
		score = 75
		quality = 71
		tags = "FILE"
		clamav_sig1 = "MALWARE_Linux.Trojan.HiddenWasp-ELF"
		clamav_sig2 = "MALWARE_Linux.Trojan.HiddenWasp-Script"

	strings:
		$x1 = "I_AM_HIDDEN" fullword ascii
		$x2 = "HIDE_THIS_SHELL" fullword ascii
		$x3 = "NewUploadFile" ascii
		$x4 = "fake_processname" ascii
		$x5 = "swapPayload" ascii
		$x6 = /Trojan-(Platform|Machine|Hostname|OSersion)/ fullword ascii
		$s1 = "FileOpration::GetFileData" fullword ascii
		$s2 = "FileOpration::NewUploadFile" fullword ascii
		$s3 = "Connection::writeBlock" fullword ascii
		$s4 = /hiding_(hidefile|enable_logging|hideproc|makeroot)/ fullword ascii
		$s5 = "Reverse-Port" fullword ascii
		$s6 = "hidden_services" fullword ascii
		$s7 = "check_config" fullword ascii
		$s8 = "__data_start" fullword ascii
		$s9 = /patch_(suger_lib|ld|lib)/ fullword ascii
		$s10 = "hexdump -ve '1/1 \"%%.2X\"' %s | sed \"s/%s/%s/g\" | xxd -r -p > %s.tmp"

	condition:
		uint16( 0 ) == 0x457f and ( 4 of ( $x* ) or all of ( $s* ) or ( 3 of ( $x* ) and 5 of ( $s* ) ) )
}