day uploader shell

Hestat · May 31, 2018 · dd43d67 · dd43d67
1 parent e82dd9e
commit dd43d67
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/includes/day_uploader_shell.yar b/includes/day_uploader_shell.yar
@@ -0,0 +1,30 @@
+/*
+   Yara Rule Set
+   Author: Brian Laskowski
+   Date: 2018-05-31
+   Identifier: case114
+   Reference: https://github.com/Hestat/lw-yara
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule sig_day_uploader_shell {
+   meta:
+      description = "case114 - file 9st48vlvfp.php"
+      author = "Brian Laskowski"
+      reference = "https://github.com/Hestat/lw-yara"
+      date = "2018-05-31"
+      hash1 = "6452039c95cf77d834e2eaa1459abf4e176c1f7158f2b86751138e5bd24e072e"
+   strings:
+      $s1 = "str_replace" fullword ascii
+      $s2 = "eval (gzinflate(base64_decode" ascii
+      $s3 = "eval"
+      $s4 = "intval(__LINE__)" fullword ascii
+      $s5 = "?php"
+   condition:
+      ( uint16(0) == 0x3f3c and
+         filesize < 5KB and
+         ( all of them )
+      ) or ( all of them )
+}
+
diff --git a/lw-rules_index.yar b/lw-rules_index.yar
@@ -38,4 +38,5 @@ include "./includes/052918_case109.yar"
 include "./includes/dedsec-symlinker.yar"
 include "./includes/drupal.js-coinhive.yar"
 include "./includes/netscrape_shell.yar"
+include "./includes/day_uploader_shell.yar"