Описание / Примечание
rule ELF_i386_Sample_040f94a3
{
meta:
author = "yara_Sample_040f94a3"
description = "Detects specific ELF 32-bit LSB (Intel 80386) sample by header + size; contains hashes in meta"
date = "2025-10-01"
filetype = "ELF"
arch = "x86 (Intel 80386) 32-bit LSB"
magic = "ELF 32-bit LSB executable, Intel 80386"
filesize_bytes = 89992
md5 = "040f94a36c62903a86cc35d187b52a4c"
sha1 = "78c5506674a1f367bb3dff59bc3b36348727b6f6"
sha256 = "00a7a0feafa3c7fe724b8e096aab680d5a3457d9aeb748daeae3034bdfcd10f3"
ssdeep = "1536:W/QCZaxGdvts3i5JPho3UxPu++ov5EUIKqI4FrS4LSC:WYCZa8dvm3oJPhqUxP595GKfUmDC"
tlsh = "T1B7937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C"
telfhash = "t10751b1fa6dba08ecfbd0a804c75e5bd33669ca7b153025b0406398b532f79954475c3a"
strings:
$elf_magic = { 7F 45 4C 46 } /* 0x7F 'E' 'L' 'F' */
condition:
// 1) ELF magic present
uint32(0) == 0x7F454C46 and
// 2) 32-bit class (EI_CLASS == 1) and little-endian (EI_DATA == 1)
uint8(4) == 1 and
uint8(5) == 1 and
// 3) machine == EM_386 (value 3)
uint16(18) == 3 and
// 4) exact filesize (fallback: use a range if sample may vary)
filesize == 89992
/* --- опция: если у вас есть модуль 'hash' в YARA, можно раскомментировать и проверить криптохэши ---
and (
hash.md5(0, filesize) == "040f94a36c62903a86cc35d187b52a4c" or
hash.sha256(0, filesize) == "00a7a0feafa3c7fe724b8e096aab680d5a3457d9aeb748daeae3034bdfcd10f3"
)
*/
}