55 lines
2 KiB
Text
55 lines
2 KiB
Text
import "hash"
|
|
import "elf"
|
|
|
|
rule VoidLink_Implant_Hash_Conosciuti
|
|
{
|
|
meta:
|
|
description = "Rileva i sample noti di VoidLink (implant principali)"
|
|
author = "Basato su Check Point Research IOC"
|
|
date = "2026-01"
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and // È un file ELF Linux
|
|
filesize < 5MB and
|
|
(
|
|
hash.sha256(0, filesize) == "05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69" or
|
|
hash.sha256(0, filesize) == "15cb93d38b0a4bd931434a501d8308739326ce482da5158eb657b0af0fa7ba49" or
|
|
hash.sha256(0, filesize) == "6850788b9c76042e0e29a318f65fceb574083ed3ec39a34bc64a1292f4586b41" or
|
|
hash.sha256(0, filesize) == "6dcfe9f66d3aef1efd7007c588a59f69e5cd61b7a8eca1fb89a84b8ccef13a2b" or
|
|
hash.sha256(0, filesize) == "28c4a4df27f7ce8ced69476cc7923cf56625928a7b4530bc7b484eec67fe3943" or
|
|
hash.sha256(0, filesize) == "e990a39e479e0750d2320735444b6c86cc26822d86a40d37d6e163d0fe058896" or
|
|
hash.sha256(0, filesize) == "4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f"
|
|
)
|
|
}
|
|
|
|
rule VoidLink_Stringhe_Core
|
|
{
|
|
meta:
|
|
description = "Trova le stringhe principali di VoidLink"
|
|
author = "Basato su analisi Check Point"
|
|
strings:
|
|
$s1 = "VoidLink" ascii fullword
|
|
$s2 = "VoidStream" ascii fullword // nome del protocollo C2
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
filesize < 5MB and
|
|
any of them
|
|
}
|
|
|
|
rule VoidLink_Plugin_Sospetti
|
|
{
|
|
meta:
|
|
description = "Rileva i plugin / moduli di VoidLink (es. _v3.o)"
|
|
author = "Basato su IOC Check Point"
|
|
strings:
|
|
$p1 = "_v3.o" ascii
|
|
$p2 = "ssh_harvester_stealth" ascii
|
|
$p3 = "port_scan_stealth" ascii
|
|
$p4 = "k8s_privesc" ascii
|
|
$p5 = "docker_escape" ascii
|
|
$p6 = "passwd_dump" ascii
|
|
$p7 = "ld_preload" ascii
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
filesize < 2MB and
|
|
any of ($p*)
|
|
}
|