Описание / Примечание
rule ELF_ARM_Sample_3a2a7d64
{
meta:
author = "ELF_ARM_Sample_3a2a7d64"
description = "Detection of specific ELF 32-bit LSB ARM executable"
date = "2025-10-01"
filetype = "ELF"
arch = "ARM 32-bit LSB"
magic = "ELF 32-bit LSB executable, ARM, SYSV"
filesize_bytes = 133920
md5 = "3a2a7d6449d1862f11499cfe5f7c6156"
sha1 = "95f574591f170d324494ecf04bf5dd586448cbb4"
sha256 = "66c072e53c37d7f779c1bde2047d137a3b6dd7e657c44c5b888efc88192c28d3"
vhash = "426177b03c790aee4e600a6d3ca1675e"
ssdeep = "1536:wKdzElm18uZJNb4A/Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGy:wKp50wU8e947LPHh+zS6thBZ6xKA"
tlsh = "T16ED30845F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// ELF header
uint32(0) == 0x7F454C46 and
// ELFCLASS32
uint8(4) == 1 and
// Little-endian (LSB)
uint8(5) == 1 and
// e_machine = EM_ARM (0x28)
uint16(18) == 0x28 and
// check file size
filesize == 133920
/* --- при желании можно включить проверку хэшей через модуль hash ---
and (
hash.md5(0, filesize) == "3a2a7d6449d1862f11499cfe5f7c6156" or
hash.sha256(0, filesize) == "66c072e53c37d7f779c1bde2047d137a3b6dd7e657c44c5b888efc88192c28d3"
)
*/
}