Описание / Примечание
rule ELF_ARM_Sample_15bd5909
{
meta:
author = "ELF_ARM_Sample_15bd5909"
description = "Detects specific ELF 32-bit LSB ARM sample by header + size"
date = "2025-10-01"
filetype = "ELF"
arch = "ARM 32-bit LSB"
magic = "ELF 32-bit LSB executable, ARM"
filesize_bytes = 129824
md5 = "15bd59093d4c60597c1c0575a1f27c8d"
sha1 = "a8d0ef5bc826ef5c21f08dae06896728183665a6"
sha256 = "60756c372fcca0e8e050b0456ca47248ff19c2bd149e136cd2cfdab2097ecfcf"
ssdeep = "1536:p3Ka0rG5yC/cMChygtIOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQy:5KaprMh7GOXWFh4UXwcFAa5xovW5kKA"
tlsh = "T1A1C31B45FC405B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// 1) ELF magic present
uint32(0) == 0x7F454C46 and
// 2) 32-bit class (EI_CLASS == 1) and little-endian (EI_DATA == 1)
uint8(4) == 1 and
uint8(5) == 1 and
// 3) machine == EM_ARM (value 40 decimal / 0x28)
uint16(18) == 0x28 and
// 4) exact filesize
filesize == 129824
/* --- опция: если доступен модуль hash ---
and (
hash.md5(0, filesize) == "15bd59093d4c60597c1c0575a1f27c8d" or
hash.sha256(0, filesize) == "60756c372fcca0e8e050b0456ca47248ff19c2bd149e136cd2cfdab2097ecfcf"
)
*/
}