27 lines
783 B
Text
27 lines
783 B
Text
|
/*
|
||
|
|
# 14ECD5E6FC8E501037B54CA263896A11 @ 0x80C2660
|
||
|
|
>>> data = '2D72647852323138502E2930216A76242521717E7F7C3B213D2E670559404646400F07475B0A0359495E74010308076915101708415F0B0C0A58592627627E64753E62302B2F29296400'.decode('hex')
|
||
|
|
>>> def decode(s):
|
||
|
|
result = ''
|
||
|
|
for i in xrange(len(s) - 5):
|
||
|
|
result += chr(ord(s[i]) ^ (i + 5))
|
||
|
|
return result
|
||
|
|
|
||
|
|
>>> decode(data)
|
||
|
|
'(tcp[8:4] & 0xe007ffff = 0x%xbebe) or (udp[12:4] & 0xe007ffff = 0x%xb'
|
||
|
|
>>>
|
||
|
|
|
||
|
|
*/
|
||
|
|
// linux apt backdoor
|
||
|
|
rule turla {
|
||
|
|
strings:
|
||
|
|
// 14ECD5E6FC8E501037B54CA263896A11 @ 0x084680
|
||
|
|
$xor_loop = { 8d4a05 328a ???????? 888a ???????? 42 83fa08 76eb }
|
||
|
|
// 14ECD5E6FC8E501037B54CA263896A11 @ 0x80c2660
|
||
|
|
$enc_string = { 2D72647852323138502E2930216A76 }
|
||
|
|
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
}
|
||
|
|
|