DITEKSHEN_MALWARE_Linux_PLEAD

rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE
{
	meta:
		description = "PLEAD Linux payload"
		author = "ditekSHen"
		id = "07aa0561-d6d9-53b6-97ac-670cdf04335d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1896-L1920"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Linux.Trojan.PLEAD"

	strings:
		$x1 = "CFileTransfer" ascii
		$x2 = "CFileManager" ascii
		$x3 = "CPortForward" ascii
		$x4 = "CPortForwardManager" ascii
		$x5 = "CRemoteShell" ascii
		$x6 = "CSockClient" ascii
		$s1 = "/proc/self/exe" fullword ascii
		$s2 = "/bin/sh" fullword ascii
		$s3 = "echo -e '" ascii
		$s4 = "%s    <DIR>    %s" ascii
		$s5 = "%s    %lld    %s" ascii
		$s6 = "Files: %d        Size: %lld" ascii
		$s7 = "Dirs: %d" ascii
		$s8 = "%s(%s)/" ascii
		$s9 = "%s %s %s %s" ascii

	condition:
		uint16( 0 ) == 0x457f and ( all of ( $x* ) or all of ( $s* ) or 12 of them )
}