YARA · SEKOIA.IO Community
SEKOIA_Unknown_7777_Xlogin
Detects the xlogin bind shell and its variants
- Author
- Sekoia.io
- Date
- 2024-07-18
- Modified
- 2024-12-19
- Score / Quality
- 75 / 80
What this rule detects
Detects the xlogin bind shell and its variants
Targets: Linux ELF.
It defines 2 patterns (0 text, 2 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
unknown-7777-xlogin.yarDetection Rule License 1.1
rule SEKOIA_Unknown_7777_Xlogin : FILE
{
meta:
= "Detects the xlogin bind shell and its variants"
= "Sekoia.io"
= "ce0beffc-f957-43ef-a739-f4a1099a7a67"
= "2024-07-18"
= "2024-12-19"
= "https://github.com/SEKOIA-IO/Community"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/unknown_7777_xlogin.yar#L1-L24"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
= "4d9067e7cf517158337123a30a9bd0e3"
= "43ea387b8294cc4d0baaef6d26ff7c72"
= "777d6f907da38365924a0c2a12e973c5"
= "8542a3cbe232fe78baa0882736c61926"
= "1c38d8019734affdebac32050097bbcf89e9069fb2145a976588eca04ecc78df"
= 75
= 80
= "FILE"
= "1.0"
= "TLP:CLEAR"
strings:
$string1 = { 2f 62 69 6e 2f 73 68 00 2f 74 6d 70 2f 6c 6f 67 69 6e }
$string2 = { 2F 64 65 76 2F 6E 75 6C 6C [1-3] 2F 62 69 6E 2F 73 68 00 2D 63 }
condition:
uint32be( 0 ) == 0x7f454c46 and filesize < 180KB and ( ( @string2 - @string1 < 3400 ) )
}
Strings (2 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $string1 | hex | { 2f 62 69 6e 2f 73 68 00 2f 74 6d 70 2f 6c 6f 67 69 6e } | |
| $string2 | hex | { 2F 64 65 76 2F 6E 75 6C 6C [1-3] 2F 62 69 6E 2F 73 68 00 2D 63 } |
Condition
uint32be( 0 ) == 0x7f454c46 and filesize < 180KB and ( ( @string2 - @string1 < 3400 ) )In plain words (Heuristic)
- The file must start with the ELF header — a Linux/Unix executable.
- The file must be smaller than 180KB (a cheap guard that skips large files).
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 4d9067e7cf517158337123a30a9bd0e3
- 43ea387b8294cc4d0baaef6d26ff7c72
- 777d6f907da38365924a0c2a12e973c5
- 8542a3cbe232fe78baa0882736c61926
Licence & attribution
Author: Sekoia.io
Source repository: SEKOIA.IO Community @ a438a5901a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: ce0beffc-f957-43ef-a739-f4a1099a7a67
Metadata
| version | 1.0 |
|---|---|
| classification | TLP:CLEAR |
Tags:FILE
Related rules
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06