Unverified Commit e0acf380 by unixfreaxjp Committed by GitHub

fixing syntax & added scan report

parent a9876ddb
/* Yara rule to detect ELF Linux process injector toolkit "mandibule" generic. /* Yara rule to detect ELF Linux process injector toolkit "mandibule" generic.
name: TOOLKIT_Mandibule.yar analyzed by unixfreaxjp. name: TOOLKIT_Mandibule.yar analyzed by unixfreaxjp.
result:
TOOLKIT_Mandibule ./mandibule//mandibule-dynx86-stripped
TOOLKIT_Mandibule ./mandibule//mandibule-dynx86-UNstripped
TOOLKIT_Mandibule ./mandibule//mandibule-dun64-UNstripped
TOOLKIT_Mandibule ./mandibule//mandibule-dyn64-stripped
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html)
and open to any user or organization, as long as you use it under this license. and open to any user or organization, as long as you use it under this license.
*/ */
...@@ -31,6 +37,7 @@ private rule is__hex_top_mandibule64 { ...@@ -31,6 +37,7 @@ private rule is__hex_top_mandibule64 {
$hex04 = { 53 48 81 EC 70 01 01 00 48 89 7C 24 08 48 8D 44 24 20 48 05 00 00 } // ld $hex04 = { 53 48 81 EC 70 01 01 00 48 89 7C 24 08 48 8D 44 24 20 48 05 00 00 } // ld
condition: condition:
3 of them 3 of them
}
private rule is__hex_mid_mandibule32 { private rule is__hex_mid_mandibule32 {
meta: meta:
...@@ -43,8 +50,6 @@ private rule is__hex_mid_mandibule32 { ...@@ -43,8 +50,6 @@ private rule is__hex_mid_mandibule32 {
$hex08 = { E8 C6 D5 FF FF 83 C4 0C 68 00 01 00 00 } // ld $hex08 = { E8 C6 D5 FF FF 83 C4 0C 68 00 01 00 00 } // ld
condition: condition:
3 of them 3 of them
} }
private rule is__elf { private rule is__elf {
...@@ -69,4 +74,3 @@ rule TOOLKIT_Mandibule { ...@@ -69,4 +74,3 @@ rule TOOLKIT_Mandibule {
and is__elf and is__elf
and filesize < 30KB and filesize < 30KB
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment