SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor

rule SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor : FILE
{
	meta:
		description = "Detects Tiny Shell - an open-source UNIX backdoor"
		author = "Mandiant"
		id = "4ad5d334-98e4-577f-89c9-86626e8feb58"
		date = "2022-03-17"
		modified = "2026-05-15"
		reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_tinyshell_slapstick.yar#L1-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "1f889871263bd6cdad8f3d4d5fc58b4a32669b944d3ed0860730374bb87d730a"
		logic_hash = "1fe9def11dced638ad38236652877427b61d7138fc8c6ce3fe7f1403c367468f"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$sb1 = { C6 00 48 C6 4? ?? 49 C6 4? ?? 49 C6 4? ?? 4C C6 4? ?? 53 C6 4? ?? 45 C6 4? ?? 54 C6 4? ?? 3D C6 4? ?? 46 C6 4? ?? 00 }
		$sb2 = { C6 00 54 C6 4? ?? 4D C6 4? ?? 45 C6 4? ?? 3D C6 4? ?? 52 }
		$ss1 = "fork" ascii fullword wide
		$ss2 = "socket" ascii fullword wide
		$ss3 = "bind" ascii fullword wide
		$ss4 = "listen" ascii fullword wide
		$ss5 = "accept" ascii fullword wide
		$ss6 = "alarm" ascii fullword wide
		$ss7 = "shutdown" ascii fullword wide
		$ss8 = "creat" ascii fullword wide
		$ss9 = "write" ascii fullword wide
		$ss10 = "open" ascii fullword wide
		$ss11 = "read" ascii fullword wide
		$ss12 = "execl" ascii fullword wide
		$ss13 = "gethostbyname" ascii fullword wide
		$ss14 = "connect" ascii fullword wide

	condition:
		uint32( 0 ) == 0x464c457f and 1 of ( $sb* ) and 10 of ( $ss* )
}