Описание / Примечание
rule main_sh4_elf
{
meta:
author = "main_sh4_elf"
description = "Detection of specific ELF 32-bit LSB ARM executable"
date = "2025-10-01"
filetype = "ELF"
arch = "ARM 32-bit LSB"
magic = "ELF 32-bit LSB executable, ARM, SYSV"
filesize_bytes = 117568
md5 = "eeb31898697a73850bb77b90e5011322 "
sha1 = "72c638c83d249d03b09cbc3c054ce6b00cab62b5"
sha256 = "6952bd1e08058bac3ab39a42d822b9d3ec1df5370058c671bc2f8486372bc7c0 "
vhash = "92533318fb6f0365eefd25090e7df146 "
ssdeep = "1536:WTW/VCxsHZusL2Li62C8vqKTR5/PPVGAto2WszrW+TNe7E:WytCxsLx62NFT7VG92WcrbwA"
tlsh = "T1B9B35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DF605BB8"
strings:
$elf_magic = { 7F 45 4C 46 }
condition:
// ELF header
uint32(0) == 0x7F454C46 and
// ELFCLASS32
uint8(4) == 1 and
// Little-endian (LSB)
uint8(5) == 1 and
// e_machine = EM_ARM (0x28)
uint16(18) == 0x28 and
// check file size
filesize == 117568
/* --- при желании можно включить проверку хэшей через модуль hash ---
and (
hash.md5(0, filesize) == "eeb31898697a73850bb77b90e5011322 " or
hash.sha256(0, filesize) == "666952bd1e08058bac3ab39a42d822b9d3ec1df5370058c671bc2f8486372bc7c0 "
)
*/
}