Detecting BPFDoor Backdoor Variants Abusing BPF Filters

These indicators are detected as Backdoor.Linux.BPFDOOR and Backdoor.Solaris.BPFDOOR.ZAJE. Additional patterns related to these samples have also been included for all Trend Micro products' monitoring and detection.

Variant A
The following samples use the known 30-instruction BPF filter:
SHA256:
fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73
3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155
bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3
fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7
a002f27f1abb599f24e727c811efa36d2d523e586a82134e9b3e8454dde6a089
144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3
ac06771774538f33b0e95a92ae1a3e8aaf27e188b51700a03c14ca097af09cac
c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d
c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc
5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9
f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27
5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3
fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a
f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72
8b84336e73c6a6d154e685d3729dfa4e08e4a3f136f0b2e7c6e5970df9145e95
599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683
96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9
76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925
07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d
dfdabe9013e783535a76407b61b63e97db283daab202218077cc0b846b3caa42
3631f806f84643aead8c4995e7bf6177d889d610cd9bdb13354aea1fc7d3a2b5
3743821d55513c52a9f06d3f6603afd167105a871e410c35a3b94e34c51089e6
8a602fb9b7c407a13f6e0af4cae702018a7d6bcf36aadb2478ce17a0b668c6d2
6fbdb38a85a416557d292566db8662d70461c8c8d0c51a0f78130c5c3646e93f
a907e1e8145f46274943fb7451c62d83f5e5e683f57a69ddb7dbb520e04e04ce
16163b5bbd624da3ed73abda5492e8c2ab84137f80b4a0210d71e0562d010eb3
7f5b419ea75b2c1fb4a7000c8d9ea2918d9a3423000506b718f8de8b4a25f157
Telfhash: t1dbe0cd85b7375828ecc715759cc452b95116d213055686345e55d6c0943b4299226f2f

Solaris sample
While Linux samples need an ICMP ECHO request if the protocol used is TCP, the sample compiled to Solaris does not check this packet type, therefore any ICMP packet would work with it as long as it contains the right magic number.
SHA256: dc8346bf443b7b453f062740d8ae8d8d7ce879672810f4296158f90359dcae3a
Telfhash: t129e02b47993a59bdf8b30460e99d5a319207cb2a09e492205f74c644586205b604de7b

Variant B
The following samples use the 39-instruction filter that adds support to magic number 0x3939339 in TCP packets:
SHA256
2e0aa3da45a0360d051359e1a038beff8551b957698f21756cfc6ed5539e4bdb
cca78516c62e1b7cf3c56b665a3537dca6beb54d335c633454b325fd44c4f760
d97625f7ad46e24fc958b1ab1c2de9591bad0127b204f99d7110fe1c401a9df4
d68948964905af7259bca015bd1d1ab0bb54334a6f08a87a40ed9d8cc966b291
Telfhash: t131e0c081fa37181cadc70b31dce453b95202e512045346248f04e7c0843fc29b229f6b

Variant C
One sample uses a BPF filter with 205 instructions. It (perhaps by mistake) checks the destination MAC address of the magic packet but has no support for the additional magic numbers:
SHA256: a9884ba3ebf25dcb1b9b3319d5e9e3706832bfa0f1fc4248f22a065f7ef15f79
Telfhash: t1a0e07d82bb376c18bcc70a356cc453b91216d222041286389e54ebc0483fc2ab225f2f

Variant D
These samples use the filter with 229 instructions. They are almost identical to Variant C, excepting for the additional ICMP ECHO check:
SHA256:
7906a1f358687ca1be8d9f531f066d6a5219857d37c13310c3239f10836007a8
28bfb3f2067c77b83898ef4e41c9fc573e6aaa8581da9b59bddb782205a0b091
b759020cbef57d96a5c978af3ae41bc1d9ffb7f3d521210a20b0d8d7540a13d4
Telfhash: t122e07d82b7375c18ecc706315cd453b91106d212041246348e14ebc0483bc29a225f2f

Variant E
This sample inserts a BPF filter containing 30 instructions, but it differs from Variant A as the magic number is not part of the BPF code. Instead, this is done by the program that loads the filter:
SHA256: afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7
Telfhash: t1b5d0a721ff751d484ab38938888d0bb656633e07e869df180a94d3c0783ea825789d8e