1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
/* Yara rule to detect Mirai Satori generic
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html)
and open to any user or organization, as long as you use it under this license.
*/
private rule is__Mirai_Satori_gen {
meta:
description = "Detects Mirai Satori_gen"
reference = "https://www.reddit.com/r/LinuxMalware/comments/7p00i3/quick_notes_for_okiru_satori_variant_of_mirai/"
date = "2018-01-05"
strings:
$st08 = "tftp -r satori" fullword nocase wide ascii
$st09 = "/bins/satori" fullword nocase wide ascii
$st10 = "satori" fullword nocase wide ascii
$st11 = "SATORI" fullword nocase wide ascii
condition:
2 of them
}
rule Mirai_Satori {
meta:
description = "Detects Mirai Satori MALW"
date = "2018-01-09"
strings:
$hexsts01 = { 63 71 75 ?? 62 6B 77 62 75 }
$hexsts02 = { 53 54 68 72 75 64 62 }
$hexsts03 = { 28 63 62 71 28 70 66 73 64 6F 63 68 60 }
condition:
all of them
and is__elf
and is__Mirai_gen7
and is__Mirai_Satori_gen
and filesize < 100KB
}