SEKOIA_Apt_Granitetyphoon_Pingpulllinux_Strings

rule SEKOIA_Apt_Granitetyphoon_Pingpulllinux_Strings : FILE
{
	meta:
		description = "Detects PingPull Linux variant"
		author = "Sekoia.io"
		id = "ee213206-d9ad-47fa-bea1-61a9d2cfba58"
		date = "2023-05-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_granitetyphoon_pingpulllinux_strings.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "89c89bb24d1996c04fba0e6ebfd2aaf1544d8a9e6333b896c1855747fb979308"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "chkconfig --add %s"
		$ = "chkconfig %s on"
		$ = "update-rc.d %s enable"
		$ = "service %s start"
		$ = "respawn limit 10 10"
		$ = "POST /%s HTTP/1.1"
		$ = "PROJECT_%s_%s_%08X"
		$ = "Description=The HTTP(S) Client"
		$ = "exec %s -f"

	condition:
		uint32be( 0 ) == 0x7f454c46 and filesize < 11MB and 7 of them
}