Saltar al contenido
yararules.org
Menú

YARA · Costin Raiu yararules

CRAIU_Unk_Liblzma_Encstrings

liblzma backdoor, encoded strings

MalwareCostin Raiu yararulesGNU General Public License v3.0Compila con YARA-X
Autor
Costin G. Raiu, Art of Noh, craiu@noh.ro
Fecha
2024-03-30
Puntuación / Calidad
75 / 85

Qué detecta esta regla

liblzma backdoor, encoded strings

Define 3 patrones (1 de texto, 2 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar
unk-liblzma-encstrings.yarGNU General Public License v3.0
rule CRAIU_Unk_Liblzma_Encstrings : FILE
{
	meta:
		description = "liblzma backdoor, encoded strings"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
		date = "2024-03-30"
		modified = "2024-03-30"
		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"

	strings:
		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 
              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00  
              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00 
              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00 
              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00  
              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
		$a3 = {
              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04  
              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00 
              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00  
              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00 
              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00 
              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }

	condition:
		( filesize < 15MB ) and ( any of them )
}

Cadenas (3 patrones)

IdentificadorTipoValorModificadores
$a1texto"yolAbejyiejuvnup=Evjtgvsh5okmkAvj"ascii wide
$a2hex{ 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 03 00 00 00 03 00 00 00 …
$a3hex{ 33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06 E2 00 00 0 …

Condición

( filesize < 15MB ) and ( any of them )

En palabras sencillas (Heurística)

  • El archivo debe ocupar menos de 15MB (un límite barato que descarta archivos grandes).
  • Debe coincidir al menos un patrón de la regla.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

Licencia y atribución

Autor: Costin G. Raiu, Art of Noh, craiu@noh.ro

Repositorio de origen: Costin Raiu yararules @ 23cf0ca220

Licencia: GNU General Public License v3.0 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: ca491b9c-400e-5f5e-9372-e403a095edba

Metadatos

version1.0

Etiquetas:FILE

Reglas relacionadas

  • CRAIU_Crime_Noabot
    MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-01-11
  • CRAIU_Unk_Liblzma_Backdoor
    MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-03-30
  • CRAIU_Crashstrike
    GenéricaCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-07-19
  • CRAIU_Susp_Ios_Shutdown
    Sospechoso / huntingCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2023-12-28