← Back to SOC feed Coverage →

Adupib SSL Backdoor

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-01T23:00:00Z · Confidence: medium

Hunt Hypothesis

The Adupib SSL Backdoor detection rule identifies potential adversary use of a compromised SSL/TLS certificate to exfiltrate data or establish covert communication channels. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate long-term persistence and data exfiltration tactics that may evade traditional detection methods.

YARA Rule

rule Trojan_Win32_Adupib 
{
    
    meta:
        author = "Microsoft"
        description = "Adupib SSL Backdoor"
        original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
        unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "POLL_RATE"
        $str2 = "OP_TIME(end hour)"
        $str3 = "%d:TCP:*:Enabled"
        $str4 = "%s[PwFF_cfg%d]"
        $str5 = "Fake_GetDlgItemTextW: ***value***="

    condition:
        $str1 and $str2 and $str3 and $str4 and $str5
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Platinum.yar