SEKOIA_Bot_Lin_Zerobot_Dec22

rule SEKOIA_Bot_Lin_Zerobot_Dec22 : FILE
{
	meta:
		description = "Detect the linux Zerobot implant using specific strings"
		author = "Sekoia.io"
		id = "ce028297-a526-4a6a-95db-8762fb5895f6"
		date = "2022-08-05"
		modified = "2024-12-19"
		reference = "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/bot_lin_zerobot_dec22.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "0f4faba9873fa360615b20bc637ecb40f56e6c7f65153f61a762e378320f94c1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "rm -rf "
		$str02 = "wget http://"
		$str03 = "curl -O http://"
		$str04 = "tftp"
		$str05 = "-c get"
		$str06 = "ftpget -v -u anonymous -P"
		$str07 = "chmod 777"
		$str08 = "nohup"
		$str09 = "/dev/null 2>&1 &"
		$str10 = "zero."
		$str11 = "ppc64le"
		$str12 = "riscv64"
		$str13 = "s390x"
		$str14 = "rm -rf ~/.bash_history"
		$str15 = "history -c"

	condition:
		11 of ( $str* ) and filesize < 10KB
}