SYMBOLCOMMON_NAMEaka. SYNONYMS
elf.loerbas (Back to overview)

Loerbas


Loader and Cleaner components used in attacks against high-performance computing centers in Europe.

References
2020-05-16atdotdeRobert Helling
@online{helling:20200516:high:cf7dadf, author = {Robert Helling}, title = {{High Performance Hackers}}, date = {2020-05-16}, organization = {atdotde}, url = {https://atdotde.blogspot.com/2020/05/high-performance-hackers.html}, language = {English}, urldate = {2020-05-18} } High Performance Hackers
Loerbas
2020-05-16Cado SecurityChris Doman, James Campbell
@online{doman:20200516:recent:bb6d18e, author = {Chris Doman and James Campbell}, title = {{Recent Attacks Against Supercomputers}}, date = {2020-05-16}, organization = {Cado Security}, url = {https://www.cadosecurity.com/2020/05/16/1318/}, language = {English}, urldate = {2020-05-18} } Recent Attacks Against Supercomputers
Loerbas
2020-05-15Twitter (@nunohaien)Tillmann Werner
@online{werner:20200515:twitter:dc048d0, author = {Tillmann Werner}, title = {{Twitter Thread on attacks on high-performance computing labs}}, date = {2020-05-15}, organization = {Twitter (@nunohaien)}, url = {https://twitter.com/nunohaien/status/1261281419483140096}, language = {English}, urldate = {2020-05-18} } Twitter Thread on attacks on high-performance computing labs
Loerbas
Yara Rules
[TLP:WHITE] elf_loerbas_w0 (20200518 | detects loader module)
rule elf_loerbas_w0 {
	meta:
		author = "Tillmann Werner"
		description = "detects loader module"
		source = "https://twitter.com/nunohaien/status/1261281419483140096"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.loerbas"
        malpedia_version = "20200518"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $fragemnt = { 61 31 C2 8B 45 FC 48 98 }
    condition:
        all of them
}
[TLP:WHITE] elf_loerbas_w1 (20200518 | detects cleaner module)
rule elf_loerbas_w1 {
	meta:
		author = "Tillmann Werner"
		description = "detects cleaner module"
		source = "https://twitter.com/nunohaien/status/1261281419483140096"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.loerbas"
        malpedia_version = "20200518"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $fragemnt = { 14 CC FC 28 25 DE B9 }
    condition:
        all of them
}
Download all Yara Rules