Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1

Detects xlogin backdoor samples

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Florian Roth
Date
2024-11-11
Modified
2024-12-12
Score / Quality
80 / 85

What this rule detects

Detects xlogin backdoor samples

It defines 4 patterns (2 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-elf-xlogin-nov24-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1 : FILE
{
	meta:
		description = "Detects xlogin backdoor samples"
		author = "Florian Roth"
		id = "e8940660-ecf8-5616-9cb1-fc0a02d35689"
		date = "2024-11-11"
		modified = "2024-12-12"
		reference = "https://blog.sekoia.io/solving-the-7777-botnet-enigma-a-cybersecurity-quest/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_xlogin_nov24.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "2b09a6811a9d0447f8c6480430eb0f7e3ff64fa933d0b2e8cd6117f38382cc6a"
		hash = "d1cbf80786b1ca1ba2e5c31ec09159be276ad3d10fc0a8a0dbff229d8263ca0a"
		hash = "ff17e9bcc1ed16985713405b95745e47674ec98e3c6c889df797600718a35b2c"
		logic_hash = "42fe8a32022592ff976d6d2839d949e28f60c8958f64a20c1c3c9091fb64d31e"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$xc1 = { 6C 6F 67 69 6E 3A 00 25 73 00 00 2F 62 69 6E 2F 73 68 00 2F 74 6D 70 2F 6C 6F 67 69 6E }
		$s1 = "/tmp/login" ascii fullword
		$s2 = "npxXoudifFeEgGaACSnmcs[" ascii fullword
		$sc1 = { 28 6E 69 6C 29 00 00 00 28 6E 75 6C 6C 29 }

	condition:
		uint16( 0 ) == 0x457f and filesize < 500KB and ( 1 of ( $x* ) or 2 of them )
}

Strings (4 patterns)

IdentifierTypeValueModifiers
$xc1hex{ 6C 6F 67 69 6E 3A 00 25 73 00 00 2F 62 69 6E 2F 73 68 00 2F 74 6D 70 2F 6C 6F 67 69 6E }
$s1text"/tmp/login"ascii fullword
$s2text"npxXoudifFeEgGaACSnmcs["ascii fullword
$sc1hex{ 28 6E 69 6C 29 00 00 00 28 6E 75 6C 6C 29 }

Condition

uint16( 0 ) == 0x457f and filesize < 500KB and ( 1 of ( $x* ) or 2 of them )

In plain words (Heuristic)

  • The file must be smaller than 500KB (a cheap guard that skips large files).
  • At least 1 patterns in ( $x* ) must match.
  • At least 2 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 2b09a6811a9d0447f8c6480430eb0f7e3ff64fa933d0b2e8cd6117f38382cc6a
  • d1cbf80786b1ca1ba2e5c31ec09159be276ad3d10fc0a8a0dbff229d8263ca0a
  • ff17e9bcc1ed16985713405b95745e47674ec98e3c6c889df797600718a35b2c

Licence & attribution

Author: Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e8940660-ecf8-5616-9cb1-fc0a02d35689

Tags:FILE

Related rules