YARA · ESET malware-ioc

ESET_Mozi_Killswitch

Mozi botnet kill switch

MalwareESET malware-iocBSD 2-Clause LicenseCompiles with YARA-X

Author: Ivan Besina
Date: 2023-09-29
Modified: 2023-10-31
Score / Quality: 75 / 80

What this rule detects

Mozi botnet kill switch

It defines 4 patterns (4 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mozi-killswitch.yarBSD 2-Clause License

rule ESET_Mozi_Killswitch : FILE
{
	meta:
		description = "Mozi botnet kill switch"
		author = "Ivan Besina"
		id = "e3d34ae0-de06-5ff4-b44b-44d264b6dd29"
		date = "2023-09-29"
		modified = "2023-10-31"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/mozi/mozi.yar#L32-L51"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		logic_hash = "90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"

	strings:
		$iptables1 = "iptables -I INPUT  -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "iptables -I OUTPUT -p tcp --sport 30005 -j DROP"
		$haha = "/haha"
		$networks = "/usr/networks"

	condition:
		all of them and filesize < 500KB
}

Strings (4 patterns)

Identifier	Type	Value
$iptables1	text	"iptables -I INPUT -p tcp --destination-port 7547 -j DROP"
$iptables2	text	"iptables -I OUTPUT -p tcp --sport 30005 -j DROP"
$haha	text	"/haha"
$networks	text	"/usr/networks"

Condition

all of them and filesize < 500KB

In plain words (Heuristic)

The file must be smaller than 500KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/eset/malware-ioc/

Licence & attribution

Author: Ivan Besina

Source repository: ESET malware-ioc @ 17baf44964

Licence: BSD 2-Clause License (stated in the rule's own meta)

“BSD 2-Clause”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e3d34ae0-de06-5ff4-b44b-44d264b6dd29

Metadata

version	1

Tags:FILE