YARA · SEKOIA.IO Community
SEKOIA_Apt_Gobrat_2
Detects GobRat related files
- Author
- Sekoia.io
- Date
- 2024-09-10
- Modified
- 2024-12-19
- Score / Quality
- 75 / 80
What this rule detects
Detects GobRat related files
Associated malware family: Gobrat.
Targets: Linux ELF.
It defines 2 patterns (2 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-gobrat-2.yarDetection Rule License 1.1
rule SEKOIA_Apt_Gobrat_2 : FILE
{
meta:
= "Detects GobRat related files"
= "Sekoia.io"
= "6b7e38f5-00bc-49c8-b34d-3e878bf426d8"
= "2024-09-10"
= "2024-12-19"
= "https://github.com/SEKOIA-IO/Community"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_gobrat_2.yar#L1-L16"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
= "9f2fdbe2cc39c91b2ac8904fb29a0142bf770859d17590017920203641860a13"
= 75
= 80
= "FILE"
= "1.0"
= "TLP:CLEAR"
strings:
$ = "thisisweird" ascii
$ = "ZzZzZzZzZzZz"
condition:
all of them and uint32be( 0 ) == 0x7f454c46
}
Strings (2 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $ | text | "thisisweird" | ascii |
| $ | text | "ZzZzZzZzZzZz" |
Condition
all of them and uint32be( 0 ) == 0x7f454c46In plain words (Heuristic)
- The file must start with the ELF header — a Linux/Unix executable.
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: Sekoia.io
Source repository: SEKOIA.IO Community @ a438a5901a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 6b7e38f5-00bc-49c8-b34d-3e878bf426d8
Metadata
| version | 1.0 |
|---|---|
| classification | TLP:CLEAR |
Tags:FILE
Related rules
- MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-09
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11