YARA · Volexity threat-intel
VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf
Detects a script deployed as part of DISGOMOJI malware chain.
- Author
- threatintel@volexity.com
- Date
- 2024-03-07
- Modified
- 2024-07-05
- Score / Quality
- 75 / 80
What this rule detects
Detects a script deployed as part of DISGOMOJI malware chain.
It defines 6 patterns (6 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : TRANSPARENTJASMINE FILE
{
meta:
= "Detects a script deployed as part of DISGOMOJI malware chain."
= "threatintel@volexity.com"
= "b338b3cf-22ce-5767-bdea-503e883bc84b"
= "2024-03-07"
= "2024-07-05"
= "TIB-20240318"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L188-L215"
= "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
= "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef"
= "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
= 75
= 80
= "TRANSPARENTJASMINE, FILE"
= "linux"
= "all"
= "file"
= "critical"
= "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
= 10312
= 7
strings:
$s1 = "add_lan_conf_cron_if_not_exists" wide ascii
$s2 = "download_if_not_exists" wide ascii
$s3 = "add_cron_if_not_exists" wide ascii
$s4 = "uevent_seqnum.sh" wide ascii
$s5 = "$HOME/.x86_64-linux-gnu" wide ascii
$s6 = "lanConfScriptPath" wide ascii
condition:
4 of them
}
Strings (6 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $s1 | text | "add_lan_conf_cron_if_not_exists" | wide ascii |
| $s2 | text | "download_if_not_exists" | wide ascii |
| $s3 | text | "add_cron_if_not_exists" | wide ascii |
| $s4 | text | "uevent_seqnum.sh" | wide ascii |
| $s5 | text | "$HOME/.x86_64-linux-gnu" | wide ascii |
| $s6 | text | "lanConfScriptPath" | wide ascii |
Condition
4 of themIn plain words (Heuristic)
- At least 4 patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef
Licence & attribution
Author: threatintel@volexity.com
Source repository: Volexity threat-intel @ 3a9d0b5245
Licence: BSD 2-Clause License (stated in the rule's own meta)
“See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt”
Copyright notice: Copyright 2022 by Volexity, Inc.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: b338b3cf-22ce-5767-bdea-503e883bc84b
Metadata
| os | linux |
|---|---|
| os_arch | all |
| scan_context | file |
| severity | critical |
| rule_id | 10312 |
| version | 7 |
Related rules
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-14
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-07
- APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30