rule apt_nix_elf_derusbi { meta: description = "Detects Derusbi Backdoor ELF" author = "Fidelis Cybersecurity" date = "2016/02/29" reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021" strings: $s1 = "LxMain" $s2 = "execve" $s3 = "kill" $s4 = "cp -a %s %s" $s5 = "%s &" $s6 = "dbus-daemon" $s7 = "--noprofile" $s8 = "--norc" $s9 = "TERM=vt100" $s10 = "/proc/%u/cmdline" $s11 = "loadso" $s12 = "/proc/self/exe" $s13 = "Proxy-Connection: Keep-Alive" $s14 = "Connection: Keep-Alive" $s15 = "CONNECT %s" $s16 = "HOST: %s:%d" $s17 = "User-Agent: Mozilla/4.0" $s18 = "Proxy-Authorization: Basic %s" $s19 = "Server: Apache" $s20 = "Proxy-Authenticate" $s21 = "gettimeofday" $s22 = "pthread_create" $s23 = "pthread_join" $s24 = "pthread_mutex_init" $s25 = "pthread_mutex_destroy" $s26 = "pthread_mutex_lock" $s27 = "getsockopt" $s28 = "socket" $s29 = "setsockopt" $s30 = "select" $s31 = "bind" $s32 = "shutdown" $s33 = "listen" $s34 = "opendir" $s35 = "readdir" $s36 = "closedir" $s37 = "rename" condition: uint32(0) == 0x4464c457f and all of them } rule apt_nix_elf_derusbi_kernelModule { meta: description = "Detects Derusbi Backdoor ELF Kernel Module" author = "Fidelis Cybersecurity" date = "2016/02/29" reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021" strings: $s1 = "__this_module" $s2 = "init_module" $s3 = "unhide_pid" $s4 = "is_hidden_pid" $s5 = "clear_hidden_pid" $s6 = "hide_pid" $s7 = "license" $s8 = "description" $s9 = "srcversion=" $s10 = "depends=" $s12 = "vermagic=" $s13 = "current_task" $s14 = "sock_release" $s15 = "module_layout" $s16 = "init_uts_ns" $s17 = "init_net" $s18 = "init_task" $s19 = "filp_open" $s20 = "__netlink_kernel_create" $s21 = "kfree_skb" condition: uint32(0) == 0x4464c457f and all of them } rule apt_nix_elf_Derusbi_Linux_SharedMemCreation { meta: description = "Detects Derusbi Backdoor ELF Shared Memory Creation" author = "Fidelis Cybersecurity" date = "2016/02/29" reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021" strings: $byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 } condition: uint32(0) == 0x464C457F and any of them } rule apt_nix_elf_Derusbi_Linux_Strings { meta: description = "Detects Derusbi Backdoor ELF Strings" author = "Fidelis Cybersecurity" date = "2016/02/29" reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021" strings: $a1 = "loadso" wide ascii fullword $a2 = "\nuname -a\n\n" wide ascii $a3 = "/dev/shm/.x11.id" wide ascii $a4 = "LxMain64" wide ascii nocase $a5 = "# \\u@\\h:\\w \\$ " wide ascii $b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide $b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide $b3 = "ret %d" wide fullword $b4 = "uname -a\n\n" wide ascii $b5 = "/proc/%u/cmdline" wide ascii $b6 = "/proc/self/exe" wide ascii $b7 = "cp -a %s %s" wide ascii $c1 = "/dev/pts/4" wide ascii fullword $c2 = "/tmp/1408.log" wide ascii fullword condition: uint32(0) == 0x464C457F and ( (1 of ($a*) and 4 of ($b*) ) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*) ) } rule apt_win_exe_trojan_derusbi { meta: description = "Detects Derusbi Backdoor Win32" author = "Fidelis Cybersecurity" date = "2016/02/29" reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021" strings: $sa_4 = "HOST: %s:%d" $sa_6 = "User-Agent: Mozilla" $sa_7 = "Proxy-Connection: Keep-Alive" $sa_8 = "Connection: Keep-Alive" $sa_9 = "Server: Apache" $sa_12 = "ZwUnloadDriver" $sa_13 = "ZwLoadDriver" $sa_18 = "_time64" $sa_19 = "DllRegisterServer" $sa_20 = "DllUnregisterServer" $sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 } // Decode Driver $sb_1 = "PCC_CMD_PACKET" $sb_2 = "PCC_CMD" $sb_3 = "PCC_BASEMOD" $sb_4 = "PCC_PROXY" $sb_5 = "PCC_SYS" $sb_6 = "PCC_PROCESS" $sb_7 = "PCC_FILE" $sb_8 = "PCC_SOCK" $sc_1 = "bcdedit -set testsigning" wide ascii $sc_2 = "update.microsoft.com" wide ascii $sc_3 = "_crt_debugger_hook" wide ascii $sc_4 = "ue8G5" wide ascii /* $sd_1 = "NET" wide ascii */ /* disabled due to performance reasons */ $sd_2 = "\\\\.\\pipe\\%s" wide ascii $sd_3 = ".dat" wide ascii $sd_4 = "CONNECT %s:%d" wide ascii $sd_5 = "\\Device\\" wide ascii $se_1 = "-%s-%04d" wide ascii $se_2 = "-%04d" wide ascii /* $se_3 = "FAL" wide ascii */ /* disabled due to performance reasons */ /* $se_4 = "OK" wide ascii */ /* disabled due to performance reasons */ $se_5 = "2.03" wide ascii /* $se_6 = "XXXXXXXXXXXXXXX" wide ascii */ /* disabled due to memory usage reasons */ condition: uint16(0) == 0x5A4D and ( all of ($sa_*) or ( (8 of ($sa_*)) and ( (5 of ($sb_*)) or (3 of ($sc_*)) or (all of ($sd_*)) or ( 1 of ($sc_*) and all of ($se_*) ) ) ) ) }