Commit 045e0ed3 by Marc Rivero López Committed by GitHub

Update MALW_BackdoorSSH.yar

parent 970711ef
...@@ -3,13 +3,16 @@ ...@@ -3,13 +3,16 @@
*/ */
rule custom_ssh_backdoor_server : backdoor { rule custom_ssh_backdoor_server
{
meta: meta:
description = "Custome SSH backdoor based on python and paramiko - file server.py" description = "Custome SSH backdoor based on python and paramiko - file server.py"
author = "Florian Roth" author = "Florian Roth"
reference = "https://goo.gl/S46L3o" reference = "https://goo.gl/S46L3o"
date = "2015-05-14" date = "2015-05-14"
hash = "0953b6c2181249b94282ca5736471f85d80d41c9" hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
strings: strings:
$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii $s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii $s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
...@@ -17,6 +20,7 @@ rule custom_ssh_backdoor_server : backdoor { ...@@ -17,6 +20,7 @@ rule custom_ssh_backdoor_server : backdoor {
$s3 = "chan.send(command)" fullword ascii $s3 = "chan.send(command)" fullword ascii
$s4 = "print '[-] SSH negotiation failed.'" fullword ascii $s4 = "print '[-] SSH negotiation failed.'" fullword ascii
$s5 = "except paramiko.SSHException, x:" fullword ascii $s5 = "except paramiko.SSHException, x:" fullword ascii
condition: condition:
filesize < 10KB and 5 of them filesize < 10KB and 5 of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment