Règles YARA pour Exaramel

Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]

Detects contents of the configuration file used by Exaramel (plaintext)

Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]

Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]

Detects path of the unix socket created to prevent concurrent executions in Exaramel malware

Detects Strings used by Exaramel malware

Detects misc strings in Exaramel malware with typos

Detects the beginning of type _type struct for some of the most important structs in Exaramel malware

Detects names of the tasks received from the CC server in Exaramel malware

autogenerated rule brought to you by yara-signator

Exaramel Windows/Linux backdoor payload