SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor_SPARC

rule SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor_SPARC : FILE
{
	meta:
		description = "Detects Tiny Shell variant for SPARC - an open-source UNIX backdoor"
		author = "Mandiant"
		id = "0a05a316-65b7-5cdf-849b-820ab60afbbd"
		date = "2022-03-17"
		modified = "2026-05-15"
		reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_tinyshell_slapstick.yar#L31-L44"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "cda78e26c2e274d24d1e4656fcd09af2930f43af7fac01a3f410a5692d79a5ae"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$sb_xor_1 = { DA 0A 80 0C 82 18 40 0D C2 2A 00 0B 96 02 E0 01 98 03 20 01 82 1B 20 04 80 A0 00 01 82 60 20 00 98 0B 00 01 C2 4A 00 0B 80 A0 60 00 32 BF FF F5 C2 0A 00 0B 81 C3 E0 08 }
		$sb_xor_2 = { C6 4A 00 00 80 A0 E0 00 02 40 00 0B C8 0A 00 00 85 38 60 00 C4 09 40 02 84 18 80 04 C4 2A 00 00 82 00 60 01 80 A0 60 04 83 64 60 00 10 6F FF F5 90 02 20 01 81 C3 E0 08 }

	condition:
		uint32( 0 ) == 0x464C457F and ( uint16( 0x10 ) & 0x0200 == 0x0200 ) and ( uint16( 0x12 ) & 0x0200 == 0x0200 ) and 1 of them
}