18 lines
481 B
Text
18 lines
481 B
Text
|
rule LinuxIoTReaper: MALW
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "LinuxIoTReaper"
|
||
|
|
author = "Joan Soriano / @w0lfvan"
|
||
|
|
reference = "https://www.securityartwork.es/2017/11/06/analisis-linux-iotreaper/"
|
||
|
|
date = "2017-10-30"
|
||
|
|
version = "1.0"
|
||
|
|
md5 = "95b448bdf6b6c97a33e1d1dbe41678eb"
|
||
|
|
sha256 = "b463ca6c3ec7fa19cd318afdd2fa2365fa9e947771c21c4bd6a3bc2120ba7f28"
|
||
|
|
strings:
|
||
|
|
$a = "weruuoqweiur.com"
|
||
|
|
$b = "rm -f /tmp/ftpupload.sh \n"
|
||
|
|
$c = "%02x-%02x-%02x-%02x-%02x-%02x"
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|