id: gafgyt-bash-malware info: name: Gafgyt Malware - Detect author: daffainfo severity: info reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Gafgyt.yar tags: malware,file file: - extensions: - all matchers: - type: word part: raw words: - 'PONG!' - 'GETLOCALIP' - 'HTTPFLOOD' - 'LUCKYLILDUDE' condition: and