Essential information

Value / Name

d6eab543d26685f588259be6507dc60349c632f2

Confidence

100/100

Revoked

Yes

Valid from

11/05/2022 12:00

Valid until

14/08/2023 12:00

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 19:38

Author / Source

AlienVault

Description

Pattern

rule   
    APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_3 {   
   meta:   
         description =    
   "Detects BPFDoor implants used by Chinese actor Red Menshen"   
         author =    
   "Florian Roth"   
         reference =    
   "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"   
         date =    
   "2022-05-08"   
         score =    
   85   
         hash1 =    
   "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"   
         hash2 =    
   "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"   
   strings:   
   $s1   
    =    
   "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event"   
   ascii   
   fullword   
   $s2   
    =    
   "/sbin/mingetty /dev"   
   ascii   
   fullword   
   $s3   
    =    
   "pickup -l -t fifo -u"   
   ascii   
   fullword   
   condition:   
   uint16   
   (   
   0   
   )    
   ==   
   0x457f   
   and   
   filesize   
   <   
   200KB   
   and   
   2   
   of   
   them   
   or   
   all   
   of   
   them   
   }

Labels / Tags

Labels: apt bpf bpfdoor red menshen

Marking (TLP)

TLP:CLEAR