Описание / Примечание
rule ELF_x86_64_Sample_c863dc4d
{
meta:
author = "ELF_x86_64_Sample_c863dc4d"
description = "Detects specific ELF 64-bit LSB x86-64 executable"
date = "2025-10-01"
filetype = "ELF"
arch = "x86-64 64-bit LSB"
magic = "ELF 64-bit LSB executable, x86-64, SYSV"
filesize_bytes = 139800
md5 = "c863dc4d8c6e1d0a81febab3d0047581"
sha1 = "b9309a212617de954651d66563ab2a9da6efffb3"
sha256 = "6b23f63b32481953e9da4aba1edbad195ce6b7c4dd11b4d2e062136952c0d5f4"
vhash = "397d54c63083e25930f53124b80ac614"
ssdeep = "3072:79eSuygEPjt6qkWqSxdymDnYMb0YBd/gQyVGsdqml6Baj:79eSuygEPjt6qkWqtmH2laBa"
tlsh = "T1F4D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54"
telfhash = "t17951bbb0399939d8a2fbfb37730be9a45cb50a6015e172d1ceb769e2de417840cb1463"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// ELF magic
uint32(0) == 0x7F454C46 and
// ELFCLASS64
uint8(4) == 2 and
// Little-endian (LSB)
uint8(5) == 1 and
// e_machine = EM_X86_64 (62 / 0x3E)
uint16(18) == 0x3E and
// exact file size
filesize == 139800
/* --- при наличии модуля hash ---
and (
hash.md5(0, filesize) == "c863dc4d8c6e1d0a81febab3d0047581" or
hash.sha256(0, filesize) == "6b23f63b32481953e9da4aba1edbad195ce6b7c4dd11b4d2e062136952c0d5f4"
)
*/
}