Skip to content

Instantly share code, notes, and snippets.

@naari3
Last active Jun 5, 2022
Embed
What would you like to do?
rule MalElf {
meta:
description = "Malicious ELF binary"
strings:
$x1 = {e3 82 89 e3 81 9b e3 82 93 e9 9a 8e e6 ae b5}
$x2 = {e3 82 ab e3 83 96 e3 83 88 e8 99 ab}
$x3 = {e5 bb 83 e5 a2 9f e3 81 ae e8 a1 97}
$x4 = {e3 82 a4 e3 83 81 e3 82 b8 e3 82 af e3 81 ae e3 82 bf e3 83 ab e3 83 88}
$x5 = {e3 83 89 e3 83 ad e3 83 ad e3 83 bc e3 82 b5 e3 81 b8 e3 81 ae e9 81 93}
$x6 = {e7 89 b9 e7 95 b0 e7 82 b9}
$x7 = {e3 82 b8 e3 83 a7 e3 83 83 e3 83 88}
$x8 = {e5 a4 a9 e4 bd bf}
$x9 = {e7 b4 ab e9 99 bd e8 8a b1}
$x10 = {e7 a7 98 e5 af 86 e3 81 ae e7 9a 87 e5 b8 9d}
$x11 = {82 e7 82 b9 82 f1 8a 4b 92 69}
$x12 = {83 4a 83 75 83 67 92 8e}
$x13 = {94 70 9a d0 82 cc 8a 58}
$x14 = {83 43 83 60 83 57 83 4e 82 cc 83 5e 83 8b 83 67}
$x15 = {83 68 83 8d 83 8d 81 5b 83 54 82 d6 82 cc 93 b9}
$x16 = {93 c1 88 d9 93 5f}
$x17 = {83 57 83 87 83 62 83 67}
$x18 = {93 56 8e 67}
$x19 = {8e 87 97 7a 89 d4}
$x20 = {94 e9 96 a7 82 cc 8d 63 92 e9}
$x21 = {30 89 30 5b 30 93 96 8e 6b b5}
$x22 = {30 4b 30 76}
$x23 = {5e c3 58 9f 30 6e 88 57}
$x24 = {30 a4 30 c1 30 b8 30 af 30 6e 30 bf 30 eb 30 c8}
$x25 = {30 c9 30 ed 30 ed 30 fc 30 b5 30 78 30 6e 90 53}
$x26 = {72 79 75 70 70 b9}
$x27 = {30 b8 30 e7 30 c3 30 c8}
$x28 = {59 29 4f 7f}
$x29 = {7d 2b 96 7d 82 b1}
$x30 = {79 d8 5b c6 30 6e 76 87 5e 1d}
$x31 = {2b 4d 49 6b 2d 2b 4d 46 73 2d 2b 4d 4a 4d 2d 2b 6c 6f 34 2d}
$x32 = {2b 4d 45 73 2d 2b 4d 48}
$x33 = {2b 58 73 4d 2d 2b 57 4a 38 2d 2b 4d 47 34 2d 2b}
$x34 = {2b 4d 4b 51 2d 2b 4d 4d 45 2d 2b 4d 4c 67 2d 2b 4d 4b 38 2d 2b 4d 47 34 2d 2b 4d 4c 38 2d 2b 4d}
$x35 = {2b 4d 4d 6b 2d 2b 4d 4f 30 2d 2b 4d 4f 30 2d 2b 4d 50 77 2d 2b 4d 4c 55 2d 2b 4d 48 67 2d 2b 4d}
$x36 = {2b 63 6e 6b 2d 2b 64 58 41 2d 2b 63}
$x37 = {2b 4d 4c 67 2d 2b 4d 4f 63 2d 2b 4d 4d 4d 2d 2b}
$x38 = {2b 57 53 6b 2d 2b 54 33}
$x39 = {2b 66 53 73 2d 2b 6c 6e 30 2d 2b 67}
$x40 = {2b 65 64 67 2d 2b 57 38 59 2d 2b 4d 47 34 2d 2b 64 6f 63 2d}
condition:
not (
($x1 or $x6 or $x12 or not $x21 or $x32) and
($x3 or $x5 or not $x11 or $x24 or $x35) and
(not $x3 or $x31 or $x40 or $x9 or $x27) and
($x4 or $x8 or $x10 or $x29 or $x40) and
($x4 or $x7 or $x11 or $x25 or not $x36) and
($x8 or $x14 or $x18 or $x21 or $x38) and
($x12 or $x15 or not $x20 or $x30 or $x35) and
($x19 or $x21 or not $x32 or $x33 or $x39) and
($x2 or $x37 or $x19 or not $x23) and
(not $x5 or $x14 or $x23 or $x30) and
(not $x5 or $x8 or $x18 or $x23) and
($x33 or $x22 or $x4 or $x38) and
($x2 or $x20 or $x39) and
($x3 or $x15 or not $x30) and
($x6 or not $x17 or $x30) and
($x8 or $x29 or not $x21) and
(not $x16 or $x1 or $x29) and
($x20 or $x10 or not $x5) and
(not $x13 or $x25) and
($x21 or $x28 or $x30) and
not $x2 and
$x3 and
not $x7 and
not $x10 and
not $x11 and
$x14 and
not $x15 and
not $x22 and
$x26 and
not $x27 and
$x34 and
$x36 and
$x37 and
not $x40
)
}
rule Rule_0 {
meta:
description = "Malicious ELF binary"
strings:
$x1 = {e3 82 89 e3 81 9b e3 82 93 e9 9a 8e e6 ae b5}
$x6 = {e7 89 b9 e7 95 b0 e7 82 b9}
$x12 = {83 4a 83 75 83 67 92 8e}
$x21 = {30 89 30 5b 30 93 96 8e 6b b5}
$x32 = {2b 4d 45 73 2d 2b 4d 48}
condition:
not (
($x1 or $x6 or $x12 or not $x21 or $x32)
)
}
rule Rule_1 {
meta:
description = "Malicious ELF binary"
strings:
$x3 = {e5 bb 83 e5 a2 9f e3 81 ae e8 a1 97}
$x5 = {e3 83 89 e3 83 ad e3 83 ad e3 83 bc e3 82 b5 e3 81 b8 e3 81 ae e9 81 93}
$x11 = {82 e7 82 b9 82 f1 8a 4b 92 69}
$x24 = {30 a4 30 c1 30 b8 30 af 30 6e 30 bf 30 eb 30 c8}
$x35 = {2b 4d 4d 6b 2d 2b 4d 4f 30 2d 2b 4d 4f 30 2d 2b 4d 50 77 2d 2b 4d 4c 55 2d 2b 4d 48 67 2d 2b 4d}
condition:
not (
($x3 or $x5 or not $x11 or $x24 or $x35)
)
}
rule Rule_2 {
meta:
description = "Malicious ELF binary"
strings:
$x3 = {e5 bb 83 e5 a2 9f e3 81 ae e8 a1 97}
$x9 = {e7 b4 ab e9 99 bd e8 8a b1}
$x27 = {30 b8 30 e7 30 c3 30 c8}
$x31 = {2b 4d 49 6b 2d 2b 4d 46 73 2d 2b 4d 4a 4d 2d 2b 6c 6f 34 2d}
$x40 = {2b 65 64 67 2d 2b 57 38 59 2d 2b 4d 47 34 2d 2b 64 6f 63 2d}
condition:
not (
(not $x3 or $x31 or $x40 or $x9 or $x27)
)
}
rule Rule_3 {
meta:
description = "Malicious ELF binary"
strings:
$x4 = {e3 82 a4 e3 83 81 e3 82 b8 e3 82 af e3 81 ae e3 82 bf e3 83 ab e3 83 88}
$x8 = {e5 a4 a9 e4 bd bf}
$x10 = {e7 a7 98 e5 af 86 e3 81 ae e7 9a 87 e5 b8 9d}
$x29 = {7d 2b 96 7d 82 b1}
$x40 = {2b 65 64 67 2d 2b 57 38 59 2d 2b 4d 47 34 2d 2b 64 6f 63 2d}
condition:
not (
($x4 or $x8 or $x10 or $x29 or $x40)
)
}
rule Rule_4 {
meta:
description = "Malicious ELF binary"
strings:
$x4 = {e3 82 a4 e3 83 81 e3 82 b8 e3 82 af e3 81 ae e3 82 bf e3 83 ab e3 83 88}
$x7 = {e3 82 b8 e3 83 a7 e3 83 83 e3 83 88}
$x11 = {82 e7 82 b9 82 f1 8a 4b 92 69}
$x25 = {30 c9 30 ed 30 ed 30 fc 30 b5 30 78 30 6e 90 53}
$x36 = {2b 63 6e 6b 2d 2b 64 58 41 2d 2b 63}
condition:
not (
($x4 or $x7 or $x11 or $x25 or not $x36)
)
}
rule Rule_5 {
meta:
description = "Malicious ELF binary"
strings:
$x8 = {e5 a4 a9 e4 bd bf}
$x14 = {83 43 83 60 83 57 83 4e 82 cc 83 5e 83 8b 83 67}
$x18 = {93 56 8e 67}
$x21 = {30 89 30 5b 30 93 96 8e 6b b5}
$x38 = {2b 57 53 6b 2d 2b 54 33}
condition:
not (
($x8 or $x14 or $x18 or $x21 or $x38)
)
}
rule Rule_6 {
meta:
description = "Malicious ELF binary"
strings:
$x12 = {83 4a 83 75 83 67 92 8e}
$x15 = {83 68 83 8d 83 8d 81 5b 83 54 82 d6 82 cc 93 b9}
$x20 = {94 e9 96 a7 82 cc 8d 63 92 e9}
$x30 = {79 d8 5b c6 30 6e 76 87 5e 1d}
$x35 = {2b 4d 4d 6b 2d 2b 4d 4f 30 2d 2b 4d 4f 30 2d 2b 4d 50 77 2d 2b 4d 4c 55 2d 2b 4d 48 67 2d 2b 4d}
condition:
not (
($x12 or $x15 or not $x20 or $x30 or $x35)
)
}
rule Rule_7 {
meta:
description = "Malicious ELF binary"
strings:
$x19 = {8e 87 97 7a 89 d4}
$x21 = {30 89 30 5b 30 93 96 8e 6b b5}
$x32 = {2b 4d 45 73 2d 2b 4d 48}
$x33 = {2b 58 73 4d 2d 2b 57 4a 38 2d 2b 4d 47 34 2d 2b}
$x39 = {2b 66 53 73 2d 2b 6c 6e 30 2d 2b 67}
condition:
not (
($x19 or $x21 or not $x32 or $x33 or $x39)
)
}
rule Rule_8 {
meta:
description = "Malicious ELF binary"
strings:
$x2 = {e3 82 ab e3 83 96 e3 83 88 e8 99 ab}
$x19 = {8e 87 97 7a 89 d4}
$x23 = {5e c3 58 9f 30 6e 88 57}
$x37 = {2b 4d 4c 67 2d 2b 4d 4f 63 2d 2b 4d 4d 4d 2d 2b}
condition:
not (
($x2 or $x37 or $x19 or not $x23)
)
}
rule Rule_9 {
meta:
description = "Malicious ELF binary"
strings:
$x5 = {e3 83 89 e3 83 ad e3 83 ad e3 83 bc e3 82 b5 e3 81 b8 e3 81 ae e9 81 93}
$x14 = {83 43 83 60 83 57 83 4e 82 cc 83 5e 83 8b 83 67}
$x23 = {5e c3 58 9f 30 6e 88 57}
$x30 = {79 d8 5b c6 30 6e 76 87 5e 1d}
condition:
not (
(not $x5 or $x14 or $x23 or $x30)
)
}
rule Rule_10 {
meta:
description = "Malicious ELF binary"
strings:
$x5 = {e3 83 89 e3 83 ad e3 83 ad e3 83 bc e3 82 b5 e3 81 b8 e3 81 ae e9 81 93}
$x8 = {e5 a4 a9 e4 bd bf}
$x18 = {93 56 8e 67}
$x23 = {5e c3 58 9f 30 6e 88 57}
condition:
not (
(not $x5 or $x8 or $x18 or $x23)
)
}
rule Rule_11 {
meta:
description = "Malicious ELF binary"
strings:
$x4 = {e3 82 a4 e3 83 81 e3 82 b8 e3 82 af e3 81 ae e3 82 bf e3 83 ab e3 83 88}
$x22 = {30 4b 30 76}
$x33 = {2b 58 73 4d 2d 2b 57 4a 38 2d 2b 4d 47 34 2d 2b}
$x38 = {2b 57 53 6b 2d 2b 54 33}
condition:
not (
($x33 or $x22 or $x4 or $x38)
)
}
rule Rule_12 {
meta:
description = "Malicious ELF binary"
strings:
$x2 = {e3 82 ab e3 83 96 e3 83 88 e8 99 ab}
$x20 = {94 e9 96 a7 82 cc 8d 63 92 e9}
$x39 = {2b 66 53 73 2d 2b 6c 6e 30 2d 2b 67}
condition:
not (
($x2 or $x20 or $x39)
)
}
rule Rule_13 {
meta:
description = "Malicious ELF binary"
strings:
$x3 = {e5 bb 83 e5 a2 9f e3 81 ae e8 a1 97}
$x15 = {83 68 83 8d 83 8d 81 5b 83 54 82 d6 82 cc 93 b9}
$x30 = {79 d8 5b c6 30 6e 76 87 5e 1d}
condition:
not (
($x3 or $x15 or not $x30)
)
}
rule Rule_14 {
meta:
description = "Malicious ELF binary"
strings:
$x6 = {e7 89 b9 e7 95 b0 e7 82 b9}
$x17 = {83 57 83 87 83 62 83 67}
$x30 = {79 d8 5b c6 30 6e 76 87 5e 1d}
condition:
not (
($x6 or not $x17 or $x30)
)
}
rule Rule_15 {
meta:
description = "Malicious ELF binary"
strings:
$x8 = {e5 a4 a9 e4 bd bf}
$x21 = {30 89 30 5b 30 93 96 8e 6b b5}
$x29 = {7d 2b 96 7d 82 b1}
condition:
not (
($x8 or $x29 or not $x21)
)
}
rule Rule_16 {
meta:
description = "Malicious ELF binary"
strings:
$x1 = {e3 82 89 e3 81 9b e3 82 93 e9 9a 8e e6 ae b5}
$x16 = {93 c1 88 d9 93 5f}
$x29 = {7d 2b 96 7d 82 b1}
condition:
not (
(not $x16 or $x1 or $x29)
)
}
rule Rule_17 {
meta:
description = "Malicious ELF binary"
strings:
$x5 = {e3 83 89 e3 83 ad e3 83 ad e3 83 bc e3 82 b5 e3 81 b8 e3 81 ae e9 81 93}
$x10 = {e7 a7 98 e5 af 86 e3 81 ae e7 9a 87 e5 b8 9d}
$x20 = {94 e9 96 a7 82 cc 8d 63 92 e9}
condition:
not (
($x20 or $x10 or not $x5)
)
}
rule Rule_18 {
meta:
description = "Malicious ELF binary"
strings:
$x13 = {94 70 9a d0 82 cc 8a 58}
$x25 = {30 c9 30 ed 30 ed 30 fc 30 b5 30 78 30 6e 90 53}
condition:
not (
(not $x13 or $x25)
)
}
rule Rule_19 {
meta:
description = "Malicious ELF binary"
strings:
$x21 = {30 89 30 5b 30 93 96 8e 6b b5}
$x28 = {59 29 4f 7f}
$x30 = {79 d8 5b c6 30 6e 76 87 5e 1d}
condition:
not (
($x21 or $x28 or $x30)
)
}
rule Rule_20 {
meta:
description = "Malicious ELF binary"
strings:
$x2 = {e3 82 ab e3 83 96 e3 83 88 e8 99 ab}
condition:
not (
not $x2
)
}
rule Rule_21 {
meta:
description = "Malicious ELF binary"
strings:
$x3 = {e5 bb 83 e5 a2 9f e3 81 ae e8 a1 97}
condition:
not (
$x3
)
}
rule Rule_22 {
meta:
description = "Malicious ELF binary"
strings:
$x7 = {e3 82 b8 e3 83 a7 e3 83 83 e3 83 88}
condition:
not (
not $x7
)
}
rule Rule_23 {
meta:
description = "Malicious ELF binary"
strings:
$x10 = {e7 a7 98 e5 af 86 e3 81 ae e7 9a 87 e5 b8 9d}
condition:
not (
not $x10
)
}
rule Rule_24 {
meta:
description = "Malicious ELF binary"
strings:
$x11 = {82 e7 82 b9 82 f1 8a 4b 92 69}
condition:
not (
not $x11
)
}
rule Rule_25 {
meta:
description = "Malicious ELF binary"
strings:
$x14 = {83 43 83 60 83 57 83 4e 82 cc 83 5e 83 8b 83 67}
condition:
not (
$x14
)
}
rule Rule_26 {
meta:
description = "Malicious ELF binary"
strings:
$x15 = {83 68 83 8d 83 8d 81 5b 83 54 82 d6 82 cc 93 b9}
condition:
not (
not $x15
)
}
rule Rule_27 {
meta:
description = "Malicious ELF binary"
strings:
$x22 = {30 4b 30 76}
condition:
not (
not $x22
)
}
rule Rule_28 {
meta:
description = "Malicious ELF binary"
strings:
$x26 = {72 79 75 70 70 b9}
condition:
not (
$x26
)
}
rule Rule_29 {
meta:
description = "Malicious ELF binary"
strings:
$x27 = {30 b8 30 e7 30 c3 30 c8}
condition:
not (
not $x27
)
}
rule Rule_30 {
meta:
description = "Malicious ELF binary"
strings:
$x34 = {2b 4d 4b 51 2d 2b 4d 4d 45 2d 2b 4d 4c 67 2d 2b 4d 4b 38 2d 2b 4d 47 34 2d 2b 4d 4c 38 2d 2b 4d}
condition:
not (
$x34
)
}
rule Rule_31 {
meta:
description = "Malicious ELF binary"
strings:
$x36 = {2b 63 6e 6b 2d 2b 64 58 41 2d 2b 63}
condition:
not (
$x36
)
}
rule Rule_32 {
meta:
description = "Malicious ELF binary"
strings:
$x37 = {2b 4d 4c 67 2d 2b 4d 4f 63 2d 2b 4d 4d 4d 2d 2b}
condition:
not (
$x37
)
}
rule Rule_33 {
meta:
description = "Malicious ELF binary"
strings:
$x40 = {2b 65 64 67 2d 2b 57 38 59 2d 2b 4d 47 34 2d 2b 64 6f 63 2d}
condition:
not (
not $x40
)
}
rule_file = open("rule copy.yara").read()
Rule = Struct.new(:name, :strings, :condition)
StrRule = Struct.new(:name, :body)
state = :none
strings = []
conditions = []
rule_file.split("\n").each do |line|
head = /\s+(.+?):/.match(line)
if head
state = head[1].to_sym
next
end
case state
when :strings
string = /^\s+(\$x\d{1,2}) = (\{.+?\})/.match(line)
if string
strings << StrRule.new(string[1], string[2])
end
when :condition
condition = /^\s+(.+?\$.+)/.match(line)
if condition
conditions << condition[1]
end
end
end
rules = []
i = 0
conditions.each do |condition|
strrules = condition.split(" or ").map do |r|
r.gsub(/\s+/, "").gsub("not", "").gsub("and", "").gsub("(", "").gsub(")", "")
end
cond_strings = []
strings.each do |string|
if strrules.include?(string.name)
cond_strings << "#{string.name} = #{string.body}"
end
end
ccc = condition.rpartition("and")
if ccc[1] == "and"
condition = ccc[0]
end
rules << Rule.new(
"Rule_#{i}",
cond_strings,
condition
)
i += 1
end
require 'erb'
erb = File.read('rule.yara.erb')
puts ERB.new(erb).result(binding)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment