16 lines
563 B
Text
16 lines
563 B
Text
rule Linux_Ransomware_Packer
|
|
{
|
|
meta:
|
|
description = "Packer tipici usati dai ransomware Linux"
|
|
author = "BastionGuard"
|
|
fix_notes = "FP fix: i pattern $crypt1/$crypt2 sono sequenze x86-64 generiche - limitati a filesize < 5MB per ridurre FP su binari di sistema"
|
|
|
|
strings:
|
|
$upx0 = "UPX!" ascii
|
|
$crypt1 = { 48 8B ?? ?? 48 8B ?? ?? E8 ?? ?? ?? ?? 48 89 }
|
|
$crypt2 = { E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 }
|
|
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
($upx0 or (1 of ($crypt*) and filesize < 5MB))
|
|
}
|