Описание / Примечание
rule ELF_ARM_Sample_23e7e015
{
meta:
author = "ELF_ARM_Sample_23e7e015"
description = "Detects specific ELF 32-bit LSB ARM EABI4 binary with debug_info"
date = "2025-10-01"
filetype = "ELF"
arch = "ARM 32-bit LSB EABI4"
compiler = "gcc 3.3.2 (Debian prerelease)"
magic = "ELF 32-bit LSB executable, ARM, EABI4"
filesize_bytes = 181474
md5 = "23e7e0158438147d7cfad6dbd11414d3"
sha1 = "075011f78ad091329c97773ac79222ba2f5ce80e"
sha256 = "7c9eb58beb168ee54211491813e0402577a1adefc714f8d8b58a6e22aba298c7"
ssdeep = "3072:OLe6vho1QIruCee+asuTuRebU7IVILCZQy38YhTfYo+M/Rvs1tlLn:ee6vhjIr1r+asuTuReAvLC738+x+M/RO"
tlsh = "T10D042945EA404B13C0D627B9F6DF42453333AB94D7EB73069528ABB43F8679E4F22A05"
telfhash = "t178310071567851269aa1ec64d9ed97b2652ac7171340ff32df26c0cc281a449f62ac0f"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// ELF magic
uint32(0) == 0x7F454C46 and
// ELFCLASS32 (32-bit), little-endian
uint8(4) == 1 and
uint8(5) == 1 and
// e_machine == EM_ARM (40 / 0x28)
uint16(18) == 0x28 and
// ARM EABI version (e_flags lowest 4 bits) == 4
(uint32(36) & 0xFF) == 0x04 and
// exact file size
filesize == 181474
/* --- опция: если модуль hash включен ---
and (
hash.md5(0, filesize) == "23e7e0158438147d7cfad6dbd11414d3" or
hash.sha256(0, filesize) == "7c9eb58beb168ee54211491813e0402577a1adefc714f8d8b58a6e22aba298c7"
)
*/
}