YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1

Detects unknown Linux implants (uploads from KR and MO)

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2022-05-05
Modified: 2023-12-05
Score / Quality: 90 / 85

What this rule detects

Detects unknown Linux implants (uploads from KR and MO)

It defines 8 patterns (4 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-lnx-redmenshen-bpfdoor-controller-may22-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
{
	meta:
		description = "Detects unknown Linux implants (uploads from KR and MO)"
		author = "Florian Roth (Nextron Systems)"
		id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"
		date = "2022-05-05"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L45-L76"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
		logic_hash = "8de10beea4ef2e059b16d38fb015d6f091cc517b6f0c06b6ef6868518349994d"
		score = 90
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "[-] Connect failed." ascii fullword
		$s2 = "export MYSQL_HISTFILE=" ascii fullword
		$s3 = "udpcmd" ascii fullword
		$s4 = "getshell" ascii fullword
		$op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
		$op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
		$op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }

	condition:
		uint16( 0 ) == 0x457f and filesize < 80KB and 2 of them or 5 of them
}

Strings (8 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"[-] Connect failed."	ascii fullword
$s2	text	"export MYSQL_HISTFILE="	ascii fullword
$s3	text	"udpcmd"	ascii fullword
$s4	text	"getshell"	ascii fullword
$op1	hex	{ e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
$op2	hex	{ 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
$op3	hex	{ e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
$op4	hex	{ c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }

Condition

uint16( 0 ) == 0x457f and filesize < 80KB and 2 of them or 5 of them

In plain words (Heuristic)

The file must be smaller than 80KB (a cheap guard that skips large files).
At least 2 patterns in the rule must match.
At least 5 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d
599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683
5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9
5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3
93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc
c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276
f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27
fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 1438c3bf-3c42-59d5-9f3f-2d72bdaaac42

Tags:FILE

SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24