Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript

Detects PERL scripts created by P.A.S. webshell

WebshellSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X (with warnings)
Author
FR/ANSSI/SDO
Date
2021-02-15
Modified
2024-05-25
Score / Quality
90 / 85

What this rule detects

Detects PERL scripts created by P.A.S. webshell

It defines 5 patterns (5 text, 0 hex, 0 regex).

YARA-X says: warning[unintended_pattern_in_set]: pattern `$pl_start` may be unintendedly or redundantly included in pattern set `$pl*`

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
webshell-pas-webshell-perlnetworkscript.yarDetection Rule License 1.1
rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
{
	meta:
		description = "Detects PERL scripts created by P.A.S. webshell"
		author = "FR/ANSSI/SDO"
		id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"
		date = "2021-02-15"
		modified = "2024-05-25"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L44-L62"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
		score = 90
		quality = 85
		tags = "FILE"

	strings:
		$pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
		$pl_status = "$o=\" [OK]\";$e=\" Error: \""
		$pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
		$msg1 = "print \"$l OK! I\\'m successful connected.$l\""
		$msg2 = "print \"$l OK! I\\'m accept connection.$l\""

	condition:
		filesize < 6000 and ( $pl_start at 0 and all of ( $pl* ) ) or any of ( $msg* )
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$pl_starttext"#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
$pl_statustext"$o=\" [OK]\";$e=\" Error: \""
$pl_sockettext"socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
$msg1text"print \"$l OK! I\\'m successful connected.$l\""
$msg2text"print \"$l OK! I\\'m accept connection.$l\""

Condition

filesize < 6000 and ( $pl_start at 0 and all of ( $pl* ) ) or any of ( $msg* )

In plain words (Heuristic)

  • The file must be smaller than 6000 (a cheap guard that skips large files).
  • All patterns in ( $pl* ) must match.
  • At least one pattern in ( $msg* ) must match.
  • Pattern $pl_start must be found at offset 0.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: FR/ANSSI/SDO

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 1625b63f-ead7-5712-92b4-0ce6ecc49fd4

Tags:FILE

Related rules