GTPDOOR Backdoor Detection

This YARA rule detects the GTPDOOR backdoor by identifying specific byte patterns within its code. The rule includes two main detection blocks, one for 'v1' and another for 'v2' versions of the backdoor, each looking for distinct functions related to sending results to a peer, executing remote commands, sending replies, and checking if the daemon is already running. The 'v1' block specifically targets functions like 'send_result_to_peer_v1_p*', 'execute_remote_command_v1', 'send_reply_v1_p*', and 'daemon_already_running_check_v1'. The 'v2' block targets 'send_result_to_peer_v2_p*', 'execute_remote_command_v2', and 'main_routine_v2_p*'. The rule also ensures the file is an ELF executable by checking the magic bytes at the beginning of the file.