SEKOIA_Malware_Tinyshell_Strings

rule SEKOIA_Malware_Tinyshell_Strings : FILE
{
	meta:
		description = "Detects TinyShell based on strings"
		author = "Sekoia.io"
		id = "51fe9986-cb33-4802-bb8d-fe3d4cdfdcc8"
		date = "2024-09-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/malware_tinyshell_strings.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "fffc89ebbe6ea37072077996e27f86dd"
		hash = "59a97d4fbd3a54e991dc7e1f0451acf5"
		hash = "d7ee59eab7f703bfaf1002a39b05c7b9"
		hash = "3f2dfe47d4563919d889132b2759fd9c"
		logic_hash = "18d10e7e6f0ba8a9ea7fa8446a930f84ce5eb2f3a022ce3dc62bc3f8fd5699e1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "_tsh_get_file"
		$ = "_tsh_put_file"
		$ = "_tsh_runshell"
		$ = "Authentication failed."
		$ = "pel_send_msg"
		$ = "exec bash --login"

	condition:
		3 of them and filesize < 150KB
}