YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1

Detects Turla Linux malware x64 x32

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Leonardo S.p.A.
Date: 2020-04-24
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Turla Linux malware x64 x32

It defines 10 patterns (10 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-lnx-turla-apr202004-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
{
	meta:
		description = "Detects Turla Linux malware x64 x32"
		author = "Leonardo S.p.A."
		id = "2da75433-b1c1-51b3-8f7a-a4442ca3de96"
		date = "2020-04-24"
		modified = "2023-12-05"
		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_penquin.yar#L2-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
		hash = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
		hash = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
		hash = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
		hash = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
		hash = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
		logic_hash = "1e07963c492f1e6264f01ee292e40b188ca325b76005d9d48e6dc198cb9bdcf4"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$ = "/root/.hsperfdata" ascii fullword
		$ = "Desc| Filename | size |state|" ascii fullword
		$ = "VS filesystem: %s" ascii fullword
		$ = "File already exist on remote filesystem !" ascii fullword
		$ = "/tmp/.sync.pid" ascii fullword
		$ = "rem_fd: ssl " ascii fullword
		$ = "TREX_PID=%u" ascii fullword
		$ = "/tmp/.xdfg" ascii fullword
		$ = "__we_are_happy__" ascii
		$ = "/root/.sess" ascii fullword

	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
}

Strings (10 patterns)

Identifier	Type	Value	Modifiers
$	text	"/root/.hsperfdata"	ascii fullword
$	text	"Desc\| Filename \| size \|state\|"	ascii fullword
$	text	"VS filesystem: %s"	ascii fullword
$	text	"File already exist on remote filesystem !"	ascii fullword
$	text	"/tmp/.sync.pid"	ascii fullword
$	text	"rem_fd: ssl "	ascii fullword
$	text	"TREX_PID=%u"	ascii fullword
$	text	"/tmp/.xdfg"	ascii fullword
$	text	"__we_are_happy__"	ascii
$	text	"/root/.sess"	ascii fullword

Condition

uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them

In plain words (Heuristic)

The file must be smaller than 5000KB (a cheap guard that skips large files).
At least 4 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502
8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc
8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667
1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905
2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08
3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4
5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8
d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0

Licence & attribution

Author: Leonardo S.p.A.

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2da75433-b1c1-51b3-8f7a-a4442ca3de96

Tags:FILE

SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode
APT / threat actorSignature Base (Florian Roth / Nextron)· Leonardo S.p.A.· 2020-04-24