SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1

rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
{
	meta:
		description = "Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness."
		author = "Florian Roth (Nextron Systems)"
		id = "9a1093a6-0239-5d1c-aa30-1ca725941583"
		date = "2020-08-03"
		modified = "2026-01-04"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_lnx_malware_indicators.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "1d07d424f2a66b60e55d21dff6d4c4f9f2591c3ab622dcfbc1cd989d28b44017"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "&& chmod +x" ascii
		$s2 = "|base64 -" ascii
		$s3 = " /tmp" ascii
		$s4 = "|curl " ascii
		$s5 = "whoami" ascii fullword
		$fp1 = "WITHOUT ANY WARRANTY" ascii
		$fp2 = "postinst" ascii fullword
		$fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
		$fp4 = "Free Software Foundation" ascii fullword
		$fp5 = "Too many sessions open! Use ssh_channel.close() or 'with'!"

	condition:
		filesize < 400KB and 3 of ( $s* ) and not 1 of ( $fp* )
}