YARA · Volexity threat-intel
VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings
Detects the DISGOMOJI malware using bogus strings introduced in the newer version.
- Author
- threatintel@volexity.com
- Date
- 2024-03-14
- Modified
- 2024-07-05
- Score / Quality
- 75 / 80
What this rule detects
Detects the DISGOMOJI malware using bogus strings introduced in the newer version.
It defines 6 patterns (6 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : TRANSPARENTJASMINE FILE
{
meta:
= "Detects the DISGOMOJI malware using bogus strings introduced in the newer version."
= "threatintel@volexity.com"
= "ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b"
= "2024-03-14"
= "2024-07-05"
= "TIB-20240318"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L132-L159"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
= "8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e"
= "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
= 75
= 80
= "TRANSPARENTJASMINE, FILE"
= "linux"
= "all"
= "file"
= "critical"
= "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
= 10341
= 5
strings:
$s1 = "Graphics Display Rendering" wide ascii
$s2 = "Error fetching Repository Key: %v" wide ascii
$s3 = "Error reading Repository Key: %v" wide ascii
$s4 = "Error fetching dpkg: %v" wide ascii
$s5 = "GNU Drivers Latest version v1.4.2" wide ascii
$s6 = "ps_output.txt" wide ascii
condition:
all of them
}
Strings (6 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | text | "Graphics Display Rendering" | wide ascii |
| $s2 | text | "Error fetching Repository Key: %v" | wide ascii |
| $s3 | text | "Error reading Repository Key: %v" | wide ascii |
| $s4 | text | "Error fetching dpkg: %v" | wide ascii |
| $s5 | text | "GNU Drivers Latest version v1.4.2" | wide ascii |
| $s6 | text | "ps_output.txt" | wide ascii |
Condition
all of themIn plain words (Heuristic)
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e
Licence & attribution
Author: threatintel@volexity.com
Source repository: Volexity threat-intel @ 3a9d0b5245
Licence: BSD 2-Clause License (stated in the rule's own meta)
“See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt”
Copyright notice: Copyright 2022 by Volexity, Inc.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b
Metadata
| os | linux |
|---|---|
| os_arch | all |
| scan_context | file |
| severity | critical |
| rule_id | 10341 |
| version | 5 |
Related rules
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-07
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-07
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30