Описание / Примечание
rule ELF_PowerPC_Sample_263d6e16
{
meta:
author = "ELF_PowerPC_Sample_263d6e16"
description = "Detects specific ELF 32-bit MSB PowerPC executable"
date = "2025-10-01"
filetype = "ELF"
arch = "PowerPC / Cisco 4500, 32-bit MSB"
magic = "ELF 32-bit MSB executable, PowerPC or Cisco 4500, SYSV"
filesize_bytes = 134036
md5 = "263d6e161e7a1526c338b735649425ae"
sha1 = "5b39d0203181d92a58456d8d198f6e4c1e6c8f58"
sha256 = "3216b3e9a118b1d2cba6f1361ef657e775be64eef65d4e29dae0eb3881e1ea56"
vhash = "0b5c275a50e655cfa829779903c9b5b3"
ssdeep = "1536:9roGHNTUZN1MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7Z8:nmZUiCx5t26wN7lDhLv18"
tlsh = "T14CD32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// ELF header
uint32(0) == 0x7F454C46 and
// ELFCLASS32
uint8(4) == 1 and
// Big-endian (MSB)
uint8(5) == 2 and
// e_machine = EM_PPC (0x14)
uint16(18) == 0x14 and
// file size check
filesize == 134036
/* --- опционально: проверка хэшей через модуль hash ---
and (
hash.md5(0, filesize) == "263d6e161e7a1526c338b735649425ae" or
hash.sha256(0, filesize) == "3216b3e9a118b1d2cba6f1361ef657e775be64eef65d4e29dae0eb3881e1ea56"
)
*/
}