SEKOIA_Unknown_7777_Xlogin

rule SEKOIA_Unknown_7777_Xlogin : FILE
{
	meta:
		description = "Detects the xlogin bind shell and its variants"
		author = "Sekoia.io"
		id = "ce0beffc-f957-43ef-a739-f4a1099a7a67"
		date = "2024-07-18"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/unknown_7777_xlogin.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "4d9067e7cf517158337123a30a9bd0e3"
		hash = "43ea387b8294cc4d0baaef6d26ff7c72"
		hash = "777d6f907da38365924a0c2a12e973c5"
		hash = "8542a3cbe232fe78baa0882736c61926"
		logic_hash = "1c38d8019734affdebac32050097bbcf89e9069fb2145a976588eca04ecc78df"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$string1 = { 2f 62 69 6e 2f 73 68 00 2f 74 6d 70 2f 6c 6f 67 69 6e }
		$string2 = { 2F 64 65 76 2F 6E 75 6C 6C [1-3] 2F 62 69 6E 2F 73 68 00 2D 63 }

	condition:
		uint32be( 0 ) == 0x7f454c46 and filesize < 180KB and ( ( @string2 - @string1 < 3400 ) )
}