new rules

some samples from this repo weren't detected : https://github.com/tennc/webshell
Fixes #3

1 files changed, 21 insertions, 7 deletions

diff --git a/malwares.yara b/malwares.yara
index c901d06..73195da 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -15,6 +15,7 @@ include "whitelist.yara"
         - http://sysadmin.cyklodev.com/online-php-obfuscator/
         - http://mohssen.org/SpinObf.php
         - https://code.google.com/p/carbylamine/
+        - https://github.com/tennc/webshell
 */
 
 global private rule IsPhp
@@ -56,13 +57,15 @@ private rule CloudFlareBypass
 rule ObfuscatedPhp
 {
     strings:
-        $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec)\(/  // ;eval( <- this is dodgy
+        $eval = /[;{}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
+        $b374k = /'ev'\.'al'/
         $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
-        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec)\(/
+        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
         $weevely3 = /\$\w=\$[a-zA-Z]\('',\$\w\);\$\w\(\);/  // weevely3 launcher
         $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
-        $danone = /\$s20=strtoupper\((\$[0-9A-Za-z]{1,4}\[\d+\]\.){2,9}[^\)]*\);if/
         $strange_arg = /\${\$[0-9a-zA-z]+}/
+        $too_many_chr = /(chr\([\d]+\)\.){2,}?/
+        $b64_concat = /('[A-Za-z0-9=+]*'\.){4,8}?/
     condition:
         any of them and not IsWhitelisted
 }
@@ -74,6 +77,7 @@ private rule base64
         $system = "c3lzdGVt"
         $preg_replace = "cHJlZ19yZXBsYWNl"
         $exec = "ZXhlYyg"
+        $base64_decode = "YmFzZTY0X2RlY29kZ"
     condition:
         any of them
 }
@@ -100,18 +104,20 @@ rule SuspiciousEncoding
 rule DodgyPhp
 {
     strings:
-        $vars = /\$___+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute) *\((base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|\\?\$_(GET|REQUEST|POST))/
+        $vars = /\$__+/ // $__ is rarely used in legitimate scripts
         $double_encoding = /(base64_decode\s*\(\s*){2}/
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
-        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
+        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir)['"]\)/
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
-        $pr = /preg_replace\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
+        $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
         $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
         $htaccess = "SetHandler application/x-httpd-php"
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
+        $iniset_urlinclude = /ini_set\('allow_url_include,\ * 1'\)/
+        $iis_com = /IIS:\/\/localhost\/w3svc/
 
     condition:
         (any of them or CloudFlareBypass) and not IsWhitelisted
@@ -148,6 +154,12 @@ rule DangerousPhp
         $ = "show_source" fullword
         $ = "pcntl_exec" fullword
         $ = "array_filter" fullword
+        $ = "call_user_func" fullword
+        $ = "register_shutdown_function" fullword
+        $ = "register_tick_function" fullword
+        $ = /ob_start\s*\(\s*[^\)]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
+        $ = "mb_ereg_replace_callback" fullword
+        $ = "preg_replace_callback" fullword
 
         $whitelist = /escapeshellcmd|escapeshellarg/
 
@@ -214,6 +226,8 @@ rule Websites
         $ = "www.fopo.com.ar"  /* Free Online Php Obfuscator */
         $ = "ccteam.ru"
         $ = "locus7s.com"
+        $ = "b374k"
+        $ = "www.egyspider.eu"
 
     condition:
         any of them and not IsWhitelisted