pwnlnx_backdoor_variant_4

YARA detection rule by Marc Rivero | McAfee ATR Team · Apache-2.0

Rule to detect the backdoor pwnlnx variant 4

rule pwnlnx_backdoor_variant_4 {

    meta:
    
        description = "Rule to detect the backdoor pwnlnx variant 4"
        author = "Marc Rivero | McAfee ATR Team"
        date = "2020-04-17"
        rule_version = "v1"
        malware_type = "backdoor"
        malware_family = "Backdoor:W32/Pwnlnx"
        actor_type = "Cybercrime"
        actor_group = "Unknown"
        reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
        hash = "2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc"
    
    strings:

        

        $bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000????????????000000000000??????0000000040??????????????000014??000003??0000474E55????9FECFBE5??F973??EB??2A??????????71??BD????????0000000000000000554889??53E8????????FF????????????4889??4889??4881??????????FF????????????4889??5BC9C30F1F??????554889??E8????????FF????????????C9C366666666????????????????????554889??E8????????4885??74??4C8B????4D85??74??65??8B????????????8B??????????4889??????????48C7??????????89??C1????C1????01??25????????29??48984C89????????????FF??????????C9C3660F1F????????????31??C9C36666662E????????????????554889??E8????????4889??????????48C7??????????FF??????????C9C390554889??E8????????8B??????????488B??????????488D????0FB6????3C??400F94??3C??410F94??74??4084??75??B8????????C9C30F1F????????????8B??????????39????74??3B????74??4584??74??8B??????????4801??0FB7??????????66????74??66??????75??4889??41FF??B8????????C9C30F1F??4084??74??8B??????????4801??0FB7??????????66????75??EB??0F1F????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??BE????????E8????????483D????????77??4885??74??488B????4889????31??4889??E8????????31??4883????5BC9C383????EB??660F1F??????554889??415453E8????????4989??4889??BE????????31??E8????????483D????????77??488B????31??4889??488B????4989????488B????4889????E8????????31??5B415CC9C383????EB??554889??4157415641554154534883????E8????????4889??488D????4989??4189??4889??BA????????4989??4489????4D89??E8????????488B??????????448B????4881??????????488D????75??EB??0F1F????488B????4881??????????488D????74??0FB7????4839??75??4883????31??5B415C415D415E415FC9C30F1F??????4D89??4C89??4489??4889??4C89??FF??????????4883????5B415C415D415E415FC9C30F1F????554889??4157415641554154534883????E8????????65??8B????????????4889????4889????4189??8B??????????4889??B9????????48C7??????????4889??4D89??4589??89??C1????C1????01??25????????29??F3A648984C8B????????????0F84????????B9????????48C7??????????4889??F3A60F84????????31??4585??4889??4889????4489????74??418D??????31??488D??????0FB6??4883????4889??48C1????48C1????4801??4801??4839??488D????488D????75??89????488D????4C89??E8????????4885??4889??0F84????????488B????4885??74??81????????????0F84????????488B??????????483D????????4C8D????75??EB??0F1F??????498B????483D????????4C8D????74??498B??4889??E8????????85??75??31??4883????5B415C415D415E415FC9C34589??4D89??488B????4489??4889??488B????FF??????????4883????5B415C415D415E415FC9C30F1F??????????81????????????0F85????????31??EB??488D????4C89??E8????????4885??4889??74??498B????488B??????????488B????4885??74??31??4889??4889????FF??4885??488B????0F84????????31??E9????????0F1F????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??41554154534883????E8????????4C8B??????????4989??4981??????????498D??????75??EB??0F1F????4C8B????4981??????????498D??????74??488B??4C89??E8????????85??75??4C89??E8????????488B??E8????????4889??E8????????4883????5B415C415DC9C36666662E????????????????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889?? }

        condition:

            uint16(0) == 0x457f and 
            filesize < 400KB and 
            all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1f4bdd5f-630a-47dc-b166-ddb999e57c9a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion