From 656d3a8d5c483f38fb801a5de6e910cbfe84e14a Mon Sep 17 00:00:00 2001
From: Yara Rules <yararules@gmail.com>
Date: Tue, 26 May 2015 20:04:13 +0200
Subject: [PATCH] Adding file per Issue #29

---
 malware/LinuxMoose.yar | 82 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 malware/LinuxMoose.yar

diff --git a/malware/LinuxMoose.yar b/malware/LinuxMoose.yar
new file mode 100644
index 0000000..fb3be16
--- /dev/null
+++ b/malware/LinuxMoose.yar
@@ -0,0 +1,82 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+// Linux/Moose yara rules
+// For feedback or questions contact us at: github@eset.com
+// https://github.com/eset/malware-ioc/
+//
+// These yara rules are provided to the community under the two-clause BSD
+// license as follows:
+//
+// Copyright (c) 2015, ESET
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+
+private rule is_elf
+{
+    strings:
+        $header = { 7F 45 4C 46 }
+
+    condition:
+        $header at 0
+}
+
+rule moose
+{
+    meta:
+        Author      = "Thomas Dupuy"
+        Date        = "2015/04/21"
+        Description = "Linux/Moose malware"
+        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf"
+        Source = "https://github.com/eset/malware-ioc/"
+        Contact = "github@eset.com"
+        License = "BSD 2-Clause"
+
+    strings:
+        $s0 = "Status: OK"
+        $s1 = "--scrypt"
+        $s2 = "stratum+tcp://"
+        $s3 = "cmd.so"
+        $s4 = "/Challenge"
+        $s7 = "processor"
+        $s9 = "cpu model"
+        $s21 = "password is wrong"
+        $s22 = "password:"
+        $s23 = "uthentication failed"
+        $s24 = "sh"
+        $s25 = "ps"
+        $s26 = "echo -n -e "
+        $s27 = "chmod"
+        $s28 = "elan2"
+        $s29 = "elan3"
+        $s30 = "chmod: not found"
+        $s31 = "cat /proc/cpuinfo"
+        $s32 = "/proc/%s/cmdline"
+        $s33 = "kill %s"
+
+    condition:
+        is_elf and all of them
+}
\ No newline at end of file