malware_GobRAT

YARA detection rule by JPCERT/CC Incident Response Group · NOASSERTION

GobRAT

import "elf"
rule malware_GobRAT {
    meta:
        description = "GobRAT" 
        author = "JPCERT/CC Incident Response Group" 
        hash = "C9345377CAB1A878803C3E3450BE06E0CF18B94E930090DD56F4641812FC4858"
    
    strings:
        
        $func0 = { BE 01 00 00 00 49 89 C0 49 89 D9 31 C0 48 89 CB 48 89 D1 }

        
        $func1 = { 48 FF CF 48 89 FE 48 F7 DF 48 C1 FF 3F 83 E7 10 }

        
        $func2 = { 48 89 C8 48 89 FB B9 42 00 00 00 BF ED 01 00 00 }

        
        $func3 = { 48 81 C4 90 00 00 00 C3 48 89 C1 BA 14 00 00 00 }

        
        $func4 = { 48 89 CA 48 69 CB 00 CA 9A 3B 81 E2 FF FF FF 3F 48 63 D2 48 01 D1 48 BA 00 00 1A 3D EB 03 B2 A1 }

        
        $func5 = { 48 89 D8 FF D1 B9 0E 00 00 00 48 89 C7 48 89 DE 31 C0 }

        
        $func6 = { 48 81 C4 00 02 00 00 C3 48 83 C2 30 4C 89 DE 4C 89 D7 }

        
        $func7 = { 31 FF BE 02 00 00 00 41 B8 01 00 00 00 31 C9 }

        
        $func8 = { 48 81 C4 F8 04 00 00 C3 49 89 C1 89 D0 48 89 DA 48 89 FB 48 89 CF 48 89 F1 4C 89 C6 4D 89 C8 }

        
        $func9 = { 48 D1 E2 48 C1 EA 1F 48 BE 80 7F B1 D7 0D 00 00 00 48 01 F2 }

        
        $func10 = { 4C 29 C7 48 89 FA 48 F7 DF 49 C1 E0 02 48 C1 FF 3F 49 21 F8 }

        
        $func11 = { 48 89 F8 90 FF D1 B9 14 00 00 00 48 89 C7 48 89 DE 31 C0 }

        
        $func13 = { BF 00 20 00 00 48 89 F9 FF D2 66 90 48 85 DB }

        
        $func14 = { B9 0F 00 00 00 BF 00 20 00 00 FF D6 48 85 DB }

        
        $func15 = { 48 81 C4 10 02 00 00 C3 48 89 D9 48 89 C3 }

    condition:
        (uint32(0) == 0x464C457F)
        and (elf.machine == elf.EM_X86_64)
        and (filesize > 2MB)
       and (filesize < 4MB)
       and ( 8 of ($func*) )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

aacbf63b-6238-4ea9-91e6-3cb00b53aa7c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion