SEKOIA_Tool_Gsocket_Strings

rule SEKOIA_Tool_Gsocket_Strings : FILE
{
	meta:
		description = "Detects Gsocket based on strings"
		author = "Sekoia.io"
		id = "55fb2f2b-1074-4b6d-9113-48eaeb0e1e27"
		date = "2024-06-10"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_gsocket_strings.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "c54308293a9f64b571282eac9fba01e4671ba6b0cd45936fab92d4d9af904bbb"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "proxy. It allows multiple gs-netcat clients to (securely) relay"
		$ = "GS-NETCAT(1)            General Commands Manual          GS-NETCAT(1)"
		$ = "-T      Use TOR. The gs-netcat tool will connect via TOR to the GSRN."
		$ = "-D      Daemon & Watchdog mode. Start gs-netcat as a background process"
		$ = "gs-netcat [-rlgvqwCTSDiu] [-s secret] [-k keyfile] [-L logfile] [-d IP]"
		$ = "The gs-netcat utility is a re-implementation of netcat."

	condition:
		( uint32be( 0 ) == 0x7f454c46 or uint16be( 0 ) == 0x4d5a or uint32be( 0 ) == 0xfeedface or uint32be( 0 ) == 0xcffaedfe or uint32be( 0 ) == 0xcafebabe ) and filesize > 2MB and filesize < 6MB and 2 of them
}