Aller au contenu
yararules.org
Menu

YARA · Costin Raiu yararules

CRAIU_Unk_Liblzma_Encstrings

liblzma backdoor, encoded strings

MalwareCostin Raiu yararulesGNU General Public License v3.0Compile avec YARA-X
Auteur
Costin G. Raiu, Art of Noh, craiu@noh.ro
Date
2024-03-30
Score / Qualité
75 / 85

Ce que détecte cette règle

liblzma backdoor, encoded strings

Elle définit 3 motifs (1 texte, 2 hex, 0 regex).

Résumé généré à partir des métadonnées et de la condition de la règle.

Source de la règle

Télécharger .yar
unk-liblzma-encstrings.yarGNU General Public License v3.0
rule CRAIU_Unk_Liblzma_Encstrings : FILE
{
	meta:
		description = "liblzma backdoor, encoded strings"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
		date = "2024-03-30"
		modified = "2024-03-30"
		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"

	strings:
		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 
              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00  
              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00 
              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00 
              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00  
              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
		$a3 = {
              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04  
              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00 
              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00  
              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00 
              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00 
              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }

	condition:
		( filesize < 15MB ) and ( any of them )
}

Chaînes (3 motifs)

IdentifiantTypeValeurModificateurs
$a1texte"yolAbejyiejuvnup=Evjtgvsh5okmkAvj"ascii wide
$a2hex{ 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 03 00 00 00 03 00 00 00 …
$a3hex{ 33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06 E2 00 00 0 …

Condition

( filesize < 15MB ) and ( any of them )

En clair (Heuristique)

  • Le fichier doit faire moins de 15MB (garde-fou peu coûteux qui écarte les gros fichiers).
  • Au moins un motif de la règle doit être trouvé.

Tester cette règle dans votre navigateur

Déposez un fichier pour le scanner avec cette règle grâce à YARA-X compilé en WebAssembly. Rien n’est envoyé.

Déposez un fichier ici ou cliquez pour choisirScanné localement avec YARA-X. Fichiers jusqu’à 200 Mo.

Ouvrir dans l’éditeur

Références

Licence et attribution

Auteur : Costin G. Raiu, Art of Noh, craiu@noh.ro

Dépôt source : Costin Raiu yararules @ 23cf0ca220

Licence : GNU General Public License v3.0 (licence du dépôt)

Règle d’origine

Reprise via YARA Forge 20260927, qui préfixe les noms de règles par la source et ajoute des champs meta normalisés.

Identifiant de règle: ca491b9c-400e-5f5e-9372-e403a095edba

Métadonnées

version1.0

Tags:FILE

Règles liées

  • CRAIU_Crime_Noabot
    MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-01-11
  • CRAIU_Unk_Liblzma_Backdoor
    MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-03-30
  • CRAIU_Crashstrike
    GénériqueCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-07-19
  • CRAIU_Susp_Ios_Shutdown
    Suspect / chasseCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2023-12-28