Saltar al contenido
yararules.org
Menú

YARA · Trellix Advanced Research Center

TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6

Rule to detect the backdoor pwnlnx variant 6

MalwarePwnlnxTrellix Advanced Research CenterApache License 2.0Compila con YARA-X
Autor
Marc Rivero | McAfee ATR Team
Fecha
2020-04-17
Modificada
2020-08-14
Puntuación / Calidad
75 / 70

Qué detecta esta regla

Rule to detect the backdoor pwnlnx variant 6

Familia de malware asociada: Pwnlnx.

Define 1 patrones (0 de texto, 1 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar
pwnlnx-backdoor-variant-6.yarApache License 2.0
rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the backdoor pwnlnx variant 6"
		author = "Marc Rivero | McAfee ATR Team"
		id = "56bfe9c7-4cd4-51f6-a469-da8af52d64c2"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L131-L161"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a"
		logic_hash = "29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"

	strings:
		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55????4D9585????AB6522????52AD3B??EC9B4BE8????????0000000000000000????00000000554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??41574589??415641554189??4154534889??4883????488B??????????4889????4889????4C89????483D????????4C8D????74??4C63??EB??0F1F??????498B????483D????????4C8D????74??498B??4C89??4889??E8????????85??75??4883????5B415C415D415E415F5DC30F1F??????????4589??4C8B????488B????4489??4889??488B????FF??????????4883????5B415C415D415E415F5DC3660F1F??????E8????????554889??41574589??41564D89??41554989??41544189??BA????????534889??488D????4883????4889????4889??65??8B????????????4889????31??E8????????488B??????????4881??????????488D????74??0FB7????4839??75??EB??0F1F????????????410FB7????4839??74??4C8B????4981??????????498D????75??4589??4D89??4C89??4489??4889??488B????FF??????????488B????65??33????????????75??4883????5B415C415D415E415F5DC3660F1F??????31??EB??E8????????0F1F??????662E0F1F????????????E8????????55BF????????4889??4881??????????65??8B????????????4889????31??488D??????????FF????????????B9????????4889??488D??????????F3??A5488D??????????48C7??????????BE????????B1??E8????????4885??74??48BA???????? }

	condition:
		uint16( 0 ) == 0x457f and filesize < 700KB and all of them
}

Cadenas (1 patrones)

IdentificadorTipoValorModificadores
$bphex{ 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55 …

Condición

uint16( 0 ) == 0x457f and filesize < 700KB and all of them

En palabras sencillas (Heurística)

  • El archivo debe ocupar menos de 700KB (un límite barato que descarta archivos grandes).
  • Deben coincidir todos los patrones de la regla.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

Hashes de muestras

Hashes de las muestras que el autor lista en los metadatos de la regla (búscalos en tu plataforma de threat intelligence).

  • d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a

Licencia y atribución

Autor: Marc Rivero | McAfee ATR Team

Repositorio de origen: Trellix Advanced Research Center @ 1919562a59

Licencia: Apache License 2.0 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: 56bfe9c7-4cd4-51f6-a469-da8af52d64c2

Metadatos

rule_versionv1
malware_typebackdoor
malware_familyBackdoor:W32/Pwnlnx
actor_typeCybercrime
actor_groupUnknown

Etiquetas:BACKDOORFILE

Reglas relacionadas

Más reglas de Pwnlnx