Sneed-Reactivity/yara-mikesxrs/Florian Roth/apt_backdoor_ssh_python.yar
Sam Sneed 08e8d462fe OMG ISTG PLS WORK
RED PILL 🔴 💊
2024-07-25 12:43:35 -05:00

18 lines
723 B
Text

rule custom_ssh_backdoor_server {
meta:
description = "Custome SSH backdoor based on python and paramiko - file server.py"
author = "Florian Roth"
reference = "https://goo.gl/S46L3o"
date = "2015-05-14"
hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
strings:
$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
$s3 = "chan.send(command)" fullword ascii
$s4 = "print '[-] SSH negotiation failed.'" fullword ascii
$s5 = "except paramiko.SSHException, x:" fullword ascii
condition:
filesize < 10KB and 5 of them
}