SIGNATURE_BASE_APT_Virtualizor_Compromise_Forensicartifacts_Aug26

rule SIGNATURE_BASE_APT_Virtualizor_Compromise_Forensicartifacts_Aug26 : FILE
{
	meta:
		description = "Detects forensic artifacts found in a campaign against compromised hosting providers using Virtualizor software"
		author = "Florian Roth"
		id = "4467e563-9652-50f7-9de9-ca788acca042"
		date = "2026-08-31"
		modified = "2026-08-31"
		reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_virtualizor_compromise_aug26.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "2a8821419395a11f1f86ef8324e881a4c8250832e65295dcdfe992b6cc33b363"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte"
		$x2 = "/tmp/.vz_svc_done"
		$x3 = "/tmp/widdow.jar"
		$x4 = "31.77.220.138:2025"
		$sa1 = "proxyuser"
		$sb1 = "193.32.127.248"

	condition:
		filesize < 5MB and ( 1 of ( $x* ) or all of ( $s* ) )
}