Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24

Detects Perfctl malware samples

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Florian Roth
Date
2024-10-09
Modified
2024-12-12
Score / Quality
75 / 85

What this rule detects

Detects Perfctl malware samples

It defines 4 patterns (0 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-lnx-perfctl-oct24.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24 : FILE
{
	meta:
		description = "Detects Perfctl malware samples"
		author = "Florian Roth"
		id = "391513ae-3348-5297-a22a-6f06e50f06d2"
		date = "2024-10-09"
		modified = "2024-12-12"
		reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_perfctl_oct24.yar#L23-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "a6d3c6b6359ae660d855f978057aab1115b418ed277bb9047cd488f9c7850747"
		hash = "ca3f246d635bfa560f6c839111be554a14735513e90b3e6784bedfe1930bdfd6"
		logic_hash = "d47df34240f59124542acc41484e8935327490c04c4e15a558b2ffc6f9c52ea8"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$op1 = { 83 45 f8 01 8b 45 f8 48 3b 45 98 0f 82 1b ff ff ff 90 c9 c3 55 }
		$op2 = { 48 8b 55 a0 48 01 ca 0f b6 0a 48 8b 55 a8 89 c0 88 4c 02 18 8b 45 fc 83 e0 3f }
		$op3 = { 88 4c 10 58 83 45 f8 01 83 7d f8 03 0f 86 68 ff ff ff 90 c9 c3 55 }
		$op4 = { 48 83 ec 68 48 89 7d a8 48 89 75 a0 48 89 55 98 48 8b 45 a8 48 8b 00 83 e0 3f 89 45 fc }

	condition:
		uint16( 0 ) == 0x457f and filesize < 300KB and 2 of them
}

Strings (4 patterns)

IdentifierTypeValueModifiers
$op1hex{ 83 45 f8 01 8b 45 f8 48 3b 45 98 0f 82 1b ff ff ff 90 c9 c3 55 }
$op2hex{ 48 8b 55 a0 48 01 ca 0f b6 0a 48 8b 55 a8 89 c0 88 4c 02 18 8b 45 fc 83 e0 3f }
$op3hex{ 88 4c 10 58 83 45 f8 01 83 7d f8 03 0f 86 68 ff ff ff 90 c9 c3 55 }
$op4hex{ 48 83 ec 68 48 89 7d a8 48 89 75 a0 48 89 55 98 48 8b 45 a8 48 8b 00 83 e0 3f 89 45 fc }

Condition

uint16( 0 ) == 0x457f and filesize < 300KB and 2 of them

In plain words (Heuristic)

  • The file must be smaller than 300KB (a cheap guard that skips large files).
  • At least 2 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • a6d3c6b6359ae660d855f978057aab1115b418ed277bb9047cd488f9c7850747
  • ca3f246d635bfa560f6c839111be554a14735513e90b3e6784bedfe1930bdfd6

Licence & attribution

Author: Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 391513ae-3348-5297-a22a-6f06e50f06d2

Tags:FILE

Related rules