Yara Rule - 사용 된 파일 이름으로 Coathanger 파일을 감지
Yara 정의.
Yara Rule - Detects COATHANGER files by used filenames
Yara definition.
Author: NLD MIVD - JSCU
https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear
malware = "COATHANGER"
date = "2024-02-06"
$chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }
uint32(0) == 0x464c457f and filesize < 5MB and
malware = "COATHANGER"
date = "2024-02-06"
$1 = "/data2/"
$2 = "/httpsd"
$3 = "/preload.so"
$4 = "/authd"
$5 = "/tmp/packfile"
$6 = "/smartctl"
$7 = "/etc/ld.so.preload"
$8 = "/newcli"
$9 = "/bin/busybox"
(uint32(0) == 0x464c457f or uint32(4) == 0x464c457f)```
[https://github.com/Neo23x0/signature-base/commit/cecca0fdabe24031496d963bb2be179f9b092814](https://github.com/Neo23x0/signature-base/commit/cecca0fdabe24031496d963bb2be179f9b092814)