Описание / Примечание
rule ELF_M68K_Sample_4299bb31
{
meta:
author = "ELF_M68K_Sample_4299bb31"
description = "Detects specific ELF 32-bit MSB Motorola m68k sample by header + size"
date = "2025-10-01"
filetype = "ELF"
arch = "Motorola m68k 68020 (32-bit MSB)"
magic = "ELF 32-bit MSB executable, Motorola m68k"
filesize_bytes = 150464
md5 = "4299bb316b1bb178bec47f6cb3d99d8e"
sha1 = "b85bdb320f85139553641580f9eb8fb9246a2133"
sha256 = "e213b55af01cdb5a15f70e5910bdfe4c52168f3903645bf8a4644b22bd618b69"
ssdeep = "3072:RwmzTDH86Jk78lKBlpjABq2idSEQ9yWVvjbiBLMdKyAk8Uv:Rw2TDH86JafjABqHdG9y/LpyAzUv"
tlsh = "T18EE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// 1) ELF magic
uint32(0) == 0x7F454C46 and
// 2) 32-bit (EI_CLASS == 1), big-endian (EI_DATA == 2)
uint8(4) == 1 and
uint8(5) == 2 and
// 3) e_machine == EM_68K (value 0x04 decimal 4)
uint16(18) == 0x04 and
// 4) exact filesize
filesize == 150464
/* --- опция: если доступен модуль hash ---
and (
hash.md5(0, filesize) == "4299bb316b1bb178bec47f6cb3d99d8e" or
hash.sha256(0, filesize) == "e213b55af01cdb5a15f70e5910bdfe4c52168f3903645bf8a4644b22bd618b69"
)
*/
}