SIGNATURE_BASE_MAL_LNX_PLAGUE_BACKDOOR_Jul25

rule SIGNATURE_BASE_MAL_LNX_PLAGUE_BACKDOOR_Jul25 : FILE
{
	meta:
		description = "Detects Plague backdoor ELF binaries, related to PAM authentication alteration."
		author = "Pezier Pierre-Henri"
		id = "2c2e9030-fcef-58c9-9ed2-798560b8b384"
		date = "2025-07-25"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_plague.yar#L1-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39"
		hash = "7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e"
		logic_hash = "9ef7d8153c8567f85b8713467bf5b175e0c2af050e1f275fb2441bbca8d20a79"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "decrypt_phrase"
		$s2 = "init_phrases"
		$x1 = "captured_password"
		$x2 = "updateklog"
		$x3 = "init_cred_structs"
		$xop1 = {
         48 8b [4] 00    // mov     rax, cs:_ent_ptr
         8b 00           // mov     eax, [rax]
         3d ca b2 e9 f1  // cmp     eax, 0F1E9B2CAh
         74              // jz      short loc_4586
      }

	condition:
		uint32be( 0 ) == 0x7f454c46 and filesize < 1MB and 2 of them
}