Описание / Примечание
rule ELF_MIPS_Sample_d1257651
{
meta:
author = "ELF_MIPS_Sample_d1257651"
description = "Detects specific ELF 32-bit MSB MIPS sample by header + size"
date = "2025-10-01"
filetype = "ELF"
arch = "MIPS 32-bit MSB"
magic = "ELF 32-bit MSB executable, MIPS, statically linked"
filesize_bytes = 173888
md5 = "d1257651071bdc13a66f80c2fe0c4421"
sha1 = "d8aa7d4aca9713278ea096fcd575aac113cf77b3"
sha256 = "1d327dfa4832182b21fac4dd8d2bb589ac0f74f0edeec08ca4ff6e058e01b28e"
ssdeep = "3072:jg57Rd7LHZwbq1YSBan1yvbysxr1uGSBI:jglRd7LHZ0Bqyy1BSBI"
tlsh = "T1A404881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// 1) ELF magic
uint32(0) == 0x7F454C46 and
// 2) 32-bit (EI_CLASS == 1), big-endian (EI_DATA == 2)
uint8(4) == 1 and
uint8(5) == 2 and
// 3) e_machine == EM_MIPS (0x08 / 8 decimal)
uint16(18) == 0x08 and
// 4) exact filesize
filesize == 173888
/* --- при наличии модуля hash можно раскомментировать ---
and (
hash.md5(0, filesize) == "d1257651071bdc13a66f80c2fe0c4421" or
hash.sha256(0, filesize) == "1d327dfa4832182b21fac4dd8d2bb589ac0f74f0edeec08ca4ff6e058e01b28e"
)
*/
}