YARAhub

You are currently viewing the YARAhub entry of the YARA rule Linux_Ancient_Bot. Depending on the TLP classification of this YARA rule chosen by the author, further information about this YARA rule is available below.

YARA Rule Details: Linux_Ancient_Bot

YARA Rule Content Copy Download

The content of the YARA rule is shown below.

rule Linux_Ancient_Bot
{
    meta:
        description = "Ancient (ANCT) IoT bot ELF: persistence modules (home_persist, cron_deb, android_rc, rc_local), sysd init script and sys.service unit, toybox/busybox download chain. C2 is built at runtime, so the rule keys on the persistence layer."
        author = "KSI Digital"
        date = "2026-10-07"
        reference = "https://github.com/ksi-digital/threat-research/tree/main/ancient-botnet"
        tlp = "clear"
        yarahub_uuid = "89d356dd-326c-4817-9c03-6f0c476fd227"
        yarahub_license = "CC BY 4.0"
        yarahub_rule_matching_tlp = "TLP:WHITE"
        yarahub_rule_sharing_tlp = "TLP:WHITE"
        yarahub_reference_md5 = "48f7e7cbb8fb3d869ea10c167d882780"
        yarahub_reference_link = "https://github.com/ksi-digital/threat-research/tree/main/ancient-botnet"
    strings:
        $p1 = "home_persist" ascii
        $p2 = "cron_deb" ascii
        $p3 = "android_rc" ascii
        $p4 = "rc_local" ascii
        $s1 = "/etc/init.d/sysd" ascii
        $s2 = "# Provides: sysd" ascii
        $s3 = "/etc/profile.d/sys.sh" ascii
        $s4 = "sys-daemon.sh" ascii
        $s5 = "/.config/systemd/user/sys.service" ascii
        $s6 = "Description=System Service" ascii
        $d1 = "(toybox wget -O %s %s || busybox wget -O %s %s" ascii
        $d2 = "cp -f %s %s.new >/dev/null 2>&1 && chmod 777 %s.new" ascii
    condition:
        uint32(0) == 0x464c457f and filesize < 3MB and
        3 of ($p*) and 3 of ($s*) and 1 of ($d*)
}
  

YARA Rule Matches

The following table shows the most recent files matching this particular YARA rule.