/*
    Source: research.ohiiho.com/arsenal/0byt3m1n1/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_0byt3m1n1 {
    meta:
        description = "0byt3m1n1-V2 file manager webshell (zerobyte-id)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/0byt3m1n1/"
        status      = "validated"

    strings:
        $title     = "0byt3m1n1" ascii nocase
        $title2    = "zerobyte" ascii nocase
        $sname_hex = "\\x30\\x62\\x79\\x74\\x33\\x6d\\x31\\x6e\\x31" ascii
        $github    = "zerobyte-id.github.io" ascii
        $doevil    = "_doEvil" ascii
        $filesrc   = "$_GET['filesrc']" ascii
        $option    = "$_GET['option']" ascii

    condition:
        filesize < 200KB
        and ($title or $title2 or $sname_hex)
        and ($github or $doevil or $filesrc or $option)
}