Add a strrev-based detection, because skiddies are, will, skiddies.

1 files changed, 14 insertions, 1 deletions

diff --git a/php-malware-finder/common.yar b/php-malware-finder/common.yar
index ae2b784..2b0cd7d 100644
--- a/php-malware-finder/common.yar
+++ b/php-malware-finder/common.yar
@@ -56,10 +56,23 @@ private rule hex
         any of them
 }
 
+private rule strrev
+{
+    strings:
+        $globals = "slabolg" nocase fullword
+        $preg_replace = "ecalper_gerp" nocase fullword
+        $base64_decode = "edoced_46esab" nocase fullword
+        $gzinflate = "etalfnizg" nocase fullword
+    
+    condition:
+        any of them
+}
+
+
 rule SuspiciousEncoding
 {
     condition:
-        base64 or hex
+        base64 or hex or strrev
 }
 
 rule DodgyStrings