SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
{
	meta:
		description = "Detects a Linux backdoor named Fipps used by Andariel"
		author = "CISA.gov"
		id = "040bca78-8b7e-5397-8a2b-1ddeed59eea3"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L291-L307"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$a = "found mac address"
		$b = "RecvThread"
		$c = "OpenSSL-1.0.0-fipps"
		$d = "Disconnected!"

	condition:
		uint32( 0 ) == 0x464c457f and all of them
}