Clipxdaemon Linux Clipboard Hijacker
This rule set detects components of the ClipXDaemon, a Linux clipboard hijacker. The first rule, 'ClipXDaemon_Bincrypter_Loader', identifies a loader component characterized by specific strings related to process information, OpenSSL, gzip, and a pattern of variables (P, S, C, R) often used in shell scripts for unpacking, all within a small file size. The second rule, 'ClipXDaemon_ELF_Clipboard', targets the main ELF executable of ClipXDaemon. It looks for an ELF file that interacts with X11 clipboard functions (XConvertSelection, XSetSelectionOwner), attempts to masquerade its process name as 'kworker/0:2-events', and contains hardcoded cryptocurrency wallet addresses used by the attacker. Together, these rules aim to identify both the unpacking mechanism and the core functionality of the ClipXDaemon malware, which is designed to swap cryptocurrency wallet addresses from the clipboard.
YARA
