/*
    Source: research.ohiiho.com/arsenal/alfa-v4-tesla/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_hmei7_beacon {
    meta:
        description = "Hmei7 (KeluargaHmei7) supply-chain mail beacon injected into redistributed PHP shells/uploaders"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/"
        status      = "validated"
        severity    = "high"

    strings:
        $hmei7_b64  = "JHR1anVhbm1haWwgPSAnS2VsdWFyZ2FIbWVpN0B5YW5kZXguY29t" ascii  // b64 "$tujuanmail = 'KeluargaHmei7@yandex.com"
        $hmei7_mail = "KeluargaHmei7@yandex.com" ascii

    condition:
        filesize < 500KB
        and ($hmei7_b64 or $hmei7_mail)
}