MAL_LNX_Bot_Oct26

Rule Info

Name
MAL_LNX_Bot_Oct26
Author
Pezier Pierre-Henri
Description
Detects Linux botnet with ELF infection, persistance and anti debug capabilities
Score
80
Reference
Internal Research
Date
2026-10-16
Minimum Yara
3.5.0
Rule Hash
1525e63f1627790109db2ecd03ca6e9d
Tags
['FILE', 'MAL', 'LINUX']
Required Modules
[]
Virustotal Matches
https://www.virustotal.com/gui/search/mal_lnx_bot_oct26/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
11
Clean (0 engines)
0

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-10-27 10:19:56
2
64
b3914f3bcb9a1c7fb8b2d3b63f0674d548635331baad02783fd1e7ef0de6e18c
2026-10-27 03:56:08
2
61
0dd3d134438993596c54d8e282ccbcafb757b1cc4ad41b8329235021465664ad
2026-10-26 21:13:47
5
63
24680e7d0a13d137cdf3bcfaaa6f687206a223a8cb349b30aaf8e60ecb56d67b
2026-10-26 16:39:37
2
64
6510fd37980400065ed3adf818e284209b138f9d9dd56d941e7c432803de281c
2026-10-25 00:36:56
2
65
5da30a55b2876f92fb784ae64a291377a93f1003a7e752f832d17738d69db766
2026-10-23 21:43:18
2
64
c18b61204cd323c6238ffb728aa30e86a0a479f974352ebd8369ea4c4649e7a3
2026-10-23 20:36:48
2
63
dda072e2569a612903a2f1d003bddf4751269c0e535d15794a5754a10632d20c
2026-10-23 07:18:46
8
64
32feeee06e8277cf021af45b62293b8df4020389ee65a00cb1c242687d54d1f1
2026-10-23 05:03:45
4
64
0c9426e093eff84ba99ec51676a4463c1abe31eb81e12b2106e38312c10de6dc
2026-10-23 01:11:19
5
58
b7bf9a465cc821b2b0d9bd47bd2d88741dcae345195578aa978c7d645166d369
2026-10-20 01:21:47
1
63
1abc838a6d94994887bd9a8653198bf70f593365067647b046f8d5babf3e94d5

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022