Skip to content
yararules.org
Menu

YARA · ditekSHen detection

DITEKSHEN_MALWARE_Multi_Exaramel

Exaramel Windows/Linux backdoor payload

MalwareExaramelditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X
Author
ditekSHen
Date
2020-11-06
Modified
2024-11-01
Score / Quality
75 / 73

What this rule detects

Exaramel Windows/Linux backdoor payload

Associated malware family: Exaramel.

Targets: Windows PE.

It defines 28 patterns (28 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
malware-multi-exaramel.yarBSD 2-Clause License
rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
{
	meta:
		description = "Exaramel Windows/Linux backdoor payload"
		author = "ditekSHen"
		id = "014f10f3-4502-5719-93f6-4b2940f53876"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L420-L459"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig1 = "MALWARE_Linux.Backdoor.Exaramel"
		clamav_sig2 = "MALWARE_Win.Backdoor.Exaramel"

	strings:
		$s1 = "vendor/golang_org/x/crypto/" ascii
		$s2 = "vendor/golang_org/x/net/http2" ascii
		$s3 = "vendor/golang_org/x/text/unicode" ascii
		$s4 = "vendor/golang_org/x/text/transform" ascii
		$s5 = "config.json" ascii
		$cmd1 = "App.Update" ascii
		$cmd2 = "App.Delete" ascii
		$cmd3 = "App.SetProxy" ascii
		$cmd4 = "App.SetServer" ascii
		$cmd5 = "App.SetTimeout" ascii
		$cmd6 = "IO.WriteFile" ascii
		$cmd7 = "IO.ReadFile" ascii
		$cmd8 = "OS.ShellExecute" ascii
		$cmd9 = "awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;" ascii
		$ws1 = "/commands/@slp" wide
		$ws2 = "/commands/cmd" wide
		$ws3 = "/settings/proxy/@password" wide
		$ws4 = "/settings/servers/server[@current='true']" wide
		$ws5 = "/settings/servers/server/@current[text()='true']" wide
		$ws6 = "/settings/servers/server[text()='%s']/@current" wide
		$ws7 = "/settings/servers/server[%d]" wide
		$ws8 = "/settings/storage" wide
		$ws9 = "/settings/check" wide
		$ws10 = "/settings/interval" wide
		$ws11 = "report.txt" wide
		$ws12 = "stg%02d.cab" ascii
		$ws13 = "urlmon.dll" ascii
		$ws14 = "ReportDir" ascii

	condition:
		( uint16( 0 ) == 0x457f and ( all of ( $s* ) and 6 of ( $cmd* ) ) ) or ( uint16( 0 ) == 0x5a4d and 12 of ( $ws* ) )
}

Strings (28 patterns)

IdentifierTypeValueModifiers
$s1text"vendor/golang_org/x/crypto/"ascii
$s2text"vendor/golang_org/x/net/http2"ascii
$s3text"vendor/golang_org/x/text/unicode"ascii
$s4text"vendor/golang_org/x/text/transform"ascii
$s5text"config.json"ascii
$cmd1text"App.Update"ascii
$cmd2text"App.Delete"ascii
$cmd3text"App.SetProxy"ascii
$cmd4text"App.SetServer"ascii
$cmd5text"App.SetTimeout"ascii
$cmd6text"IO.WriteFile"ascii
$cmd7text"IO.ReadFile"ascii
$cmd8text"OS.ShellExecute"ascii
$cmd9text"awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;"ascii
$ws1text"/commands/@slp"wide
$ws2text"/commands/cmd"wide
$ws3text"/settings/proxy/@password"wide
$ws4text"/settings/servers/server[@current='true']"wide
$ws5text"/settings/servers/server/@current[text()='true']"wide
$ws6text"/settings/servers/server[text()='%s']/@current"wide
$ws7text"/settings/servers/server[%d]"wide
$ws8text"/settings/storage"wide
$ws9text"/settings/check"wide
$ws10text"/settings/interval"wide
$ws11text"report.txt"wide
$ws12text"stg%02d.cab"ascii
$ws13text"urlmon.dll"ascii
$ws14text"ReportDir"ascii

Condition

( uint16( 0 ) == 0x457f and ( all of ( $s* ) and 6 of ( $cmd* ) ) ) or ( uint16( 0 ) == 0x5a4d and 12 of ( $ws* ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • All patterns in ( $s* ) must match.
  • At least 6 patterns in ( $cmd* ) must match.
  • At least 12 patterns in ( $ws* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 014f10f3-4502-5719-93f6-4b2940f53876

Metadata

clamav_sig1MALWARE_Linux.Backdoor.Exaramel
clamav_sig2MALWARE_Win.Backdoor.Exaramel

Tags:FILE

Related rules

More Exaramel rules