From 6beeeebe3c43f0643e521139d3f8b1ff4a7f3059 Mon Sep 17 00:00:00 2001 From: Julien Voisin Date: Thu, 5 Mar 2015 15:36:22 +0100 Subject: Yara is cooler than Python --- malwares.yara | 161 + modules.conf | 20 - modules/__init__.py | 0 modules/entropy.py | 56 - modules/grep_count.py | 234 - modules/levenshtein.py | 73 - modules/libfuzzy.py | 98 - modules/scanmodule.py | 56 - modules/whitelist.py | 46 - scanner.py | 44 - script.sh | 2 +- serialized.hashwhitelist | 157118 -------------------------------------------- test.hashwhitelist | 157118 -------------------------------------------- 13 files changed, 162 insertions(+), 314864 deletions(-) create mode 100644 malwares.yara delete mode 100644 modules.conf delete mode 100644 modules/__init__.py delete mode 100644 modules/entropy.py delete mode 100644 modules/grep_count.py delete mode 100644 modules/levenshtein.py delete mode 100644 modules/libfuzzy.py delete mode 100644 modules/scanmodule.py delete mode 100644 modules/whitelist.py delete mode 100644 scanner.py delete mode 100644 serialized.hashwhitelist delete mode 100644 test.hashwhitelist diff --git a/malwares.yara b/malwares.yara new file mode 100644 index 0000000..3d857c1 --- /dev/null +++ b/malwares.yara @@ -0,0 +1,161 @@ +private rule IsPhp +{ + strings: + $php = " 5 or #hexvars > 5) +} + +rule CloudFlareBypass +{ + strings: + $chk_jschl = "chk_jschl" + $jschl_vc = "jschl_vc" + $jschl_answer = "jschl_answer" + + condition: + 2 of them // Better be safe than sorry +} + +rule DodgyPhp +{ + strings: + $execution = /(eval|passthru|exec|system|win_shell_execute)\((base64_decode|php:\/\/input|str_rot13|gzinflate|getenv|\\?\$_(GET|REQUEST|POST))/ + $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/ + $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/ + $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/ + $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/ + $various = "