YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_LNX_Byteencoder_Jan25

Detects Linux binaries that encode bytes by splitting them into upper and lower nibbles and mapping them to custom lookup tables, seen being used by SEASPY and Bluez backdoors

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: MalGamy (Nextron System)
Date: 2025-01-23
Modified: 2025-03-20
Score / Quality: 75 / 85

What this rule detects

Detects Linux binaries that encode bytes by splitting them into upper and lower nibbles and mapping them to custom lookup tables, seen being used by SEASPY and Bluez backdoors

Targets: Linux ELF.

It defines 2 patterns (0 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-lnx-byteencoder-jan25.yarDetection Rule License 1.1

rule SIGNATURE_BASE_SUSP_LNX_Byteencoder_Jan25 : FILE
{
	meta:
		description = "Detects Linux binaries that encode bytes by splitting them into upper and lower nibbles and mapping them to custom lookup tables, seen being used by SEASPY and Bluez backdoors"
		author = "MalGamy (Nextron System)"
		id = "4866348a-2129-5f6a-9498-8ab1acfa74b4"
		date = "2025-01-23"
		modified = "2025-03-20"
		reference = "https://www.securityweek.com/newly-discovered-turla-malware-targets-linux-systems/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/seaspy_backdoor_jan25.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "3e0312ce8d0c1e5c192dbb93cac4770a1205c56dc9d02a0510c7e10a15251de5"
		hash = "301d58a6a1819466e77209dbf8ca635cbee3b45516e5ee228fea50ae4a27b7d5"
		hash = "957c0c135b50d1c209840ec7ead60912a5ccefd2873bf5722cb85354cea4eb37"
		hash = "5e3c128749f7ae4616a4620e0b53c0e5381724a790bba8314acb502ce7334df2"
		hash = "b0b83e1c69aa8df6da4383230bef1ef46e09f3bf26cec877eac53a9d48dc53ca"
		hash = "d21b40645e33638bd36b63582c2c6ad5e8230c731236a54e8e5f4139bad31fdf"
		logic_hash = "c0fe841681d3aaa8687c95f475f68b2d8b2f26afe42e9d15c601602fcc5e50cb"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$op1 = {8B 45 FC 48 63 D0 48 8B 45 A8 48 01 C2 8B 45 BC C1 F8 04 83 E0 0F 48 98 0F B6 44 05 E0 88 02}
		$op2 = {8B 45 FC 48 98 48 8D 50 01 48 8B 45 A8 48 01 C2 8B 45 BC 83 E0 0F 48 98 0F B6 44 05 C0 88 02}

	condition:
		uint32be( 0 ) == 0x7f454c46 and filesize < 4MB and all of them
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$op1	hex	{8B 45 FC 48 63 D0 48 8B 45 A8 48 01 C2 8B 45 BC C1 F8 04 83 E0 0F 48 98 0F B6 44 05 E0 88 02}
$op2	hex	{8B 45 FC 48 98 48 8D 50 01 48 8B 45 A8 48 01 C2 8B 45 BC 83 E0 0F 48 98 0F B6 44 05 C0 88 02}

Condition

uint32be( 0 ) == 0x7f454c46 and filesize < 4MB and all of them

In plain words (Heuristic)

The file must start with the ELF header — a Linux/Unix executable.
The file must be smaller than 4MB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.securityweek.com/newly-discovered-turla-malware-targets-linux-systems/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

3e0312ce8d0c1e5c192dbb93cac4770a1205c56dc9d02a0510c7e10a15251de5
301d58a6a1819466e77209dbf8ca635cbee3b45516e5ee228fea50ae4a27b7d5
957c0c135b50d1c209840ec7ead60912a5ccefd2873bf5722cb85354cea4eb37
5e3c128749f7ae4616a4620e0b53c0e5381724a790bba8314acb502ce7334df2
b0b83e1c69aa8df6da4383230bef1ef46e09f3bf26cec877eac53a9d48dc53ca
d21b40645e33638bd36b63582c2c6ad5e8230c731236a54e8e5f4139bad31fdf

Licence & attribution

Author: MalGamy (Nextron System)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4866348a-2129-5f6a-9498-8ab1acfa74b4

Tags:FILE

SIGNATURE_BASE_SUSP_LNX_Stackstring_Technique_Jan25
Suspicious / huntingSignature Base (Florian Roth / Nextron)· MalGamy (Nextron System)· 2025-01-23