YARA Detection Rule: MAL_LNX_SSHDOOR_Triton
Repository: Neo23x0/signature-base
Detects: Signature detecting 
Author: Marc-Etienne M.Leveille, modified by Florian Roth
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf

Pattern signatures:
/* SSH binaries - specific strings */
      $a_usage1 = "usage: ssh ["
      $a_usage2 = "usage: %s [options] [command [arg ...]]"
      $a_old_version1 = "-L listen-port:host:port"
      $a_old_version2 = "Listen on the specified port (default: 22)"
      $a_usage = "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]"
      /* SSH binaries - combo required */
      $ac_usage = "usage: %s [options] [file ...]\n"
      $ac_log1 = "Could not open a connection to your authentication agent.\n"
      $ac_pass2 = "Enter your OpenSSH passphrase:"
      $ac_log2 = "Could not grab %s. A malicious client may be eavesdropping on you"
      $ac_pass3 = "Enter new passphrase (empty for no passphrase):"
      $ac_log3 = "revoking certificates by key ID requires specification of a CA key"

      /* Strings from malicious files */
      /* abafar */
      $s_log_c =  "%s:%s@%s"
      $s_log_d =  "%s:%s from %s"
      /* akiva */
      $s_log_aki = /(To|From):\s(%s\s\-\s)?%s:%s\n/
      /* al

Detection condition:
uint32be(0) == 0x7f454c46 and // ELF
      ( 1 of ($a_*) or 2 of ($ac_*) ) // SSH Binary
      and (
         ( 1 of ($s*) ) or
         ( all of ($ando_s*) and ($ando_i or all of ($ando_m*)) ) or
         ( all of ($atollon*) ) or
         ( all of ($bespin*) ) or
         ( all of ($chandrila*) ) 

Full rule:
rule MAL_LNX_SSHDOOR_Triton {
   meta:
      description = "Signature detecting "
      author = "Marc-Etienne M.Leveille, modified by Florian Roth"
      email  = "leveille@eset.com"
      reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
      date = "2018-12-05"
      license = "BSD 2-Clause"
      id = "51ec2e60-d84a-5271-a7fe-e12d597be00c"
   strings:
      /* SSH binaries - specific strings */
      $a_usage1 = "usage: ssh ["
      $a_usage2 = "usage: %s [options] [command [arg ...]]"
      $a_old_version1 = "-L listen-port:host:port"
      $a_old_version2 = "Listen on the specified port (default: 22)"
      $a_usage = "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]"
      /* SSH binaries - combo required */
      $ac_usage = "usage: %s [options] [file ...]\n"
      $ac_log1 = "Could not open a connection to your authentication agent.\n"
      $ac_pass2 = "Enter your OpenSSH passphrase:"
      $ac_log2 = "Could not grab %s. A malicious client may be eavesdropping on you"
      $ac_pass3 = "Enter new passphrase (empty for no passphrase):"
      $ac_log3 = "revoking certificates by key ID requires specification of a CA key"

      /* Strings from malicious files */
      /* abafar */
      $s_log_c =  "%s:%s@%s"
      $s_log_d =  "%s:%s from %s"
      /* akiva */
      $s_log_aki = /(To|From):\s(%s\s\-\s)?%s:%s\n/
      /* alderaan */
      $s_log_ald = /login\s(in|at):\s(%s\s)?%s:%s\n/
      /* ando */
      $ando_s1 = "%s:%s\n"
      $ando_s2 = "HISTFILE"
      $ando_i = "fopen64"
      $ando_m1 = "cat "
      $ando_m2 = "mail -s"
      /* anoat */
      $s_log_ano = "%s at: %s | user: %s, pass: %s\n"
      /* batuu */
      $s_args_bat = "ssh: ~(av[%d]: %s\n)"
      $s_log_bat = "readpass: %s\n"
      /* banodan */
      $s_banodan1 = "g_server"
      $s_banodan2 = "mine.sock"
      $s_banodan3 = "tspeed"
      $s_banodan4 = "6106#x=%d#%s#%s#speed=%s"
      $s_banodan5 = "usmars.mynetge