SEKOIA_Miner_Lin_Xmrig_Strings

rule SEKOIA_Miner_Lin_Xmrig_Strings : FILE
{
	meta:
		description = "Detects XMRig ELF"
		author = "Sekoia.io"
		id = "2f99020b-424c-4433-860c-5e9ab4e1f1de"
		date = "2022-09-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/miner_lin_xmrig_strings.yar#L1-L36"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "4946e5099d7d342c8cf6644146ffec8506e786a1d4de0b05ef039bcf2b0fdad2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		modification_date = "2024-01-04"
		classification = "TLP:CLEAR"

	strings:
		$ = "XMRig "
		$ = "pool_wallet"
		$ = "IP Address currently banned"
		$ = "rigid"
		$ = "diff_current"
		$ = "shares_good"
		$ = "shares_total"
		$ = "avg_time"
		$ = "avg_time_ms"
		$ = "hashes_total"
		$ = "pool address"
		$ = "ping time"
		$ = "connection time"
		$ = "daemon+wss://"
		$ = "daemon+https://"
		$ = "daemon+http://"
		$ = "socks5://"
		$ = "stratum+ssl://"
		$ = "stratum+tcp://"

	condition:
		uint32be( 0 ) == 0x7f454c46 and filesize < 10MB and 7 of them
}