/*
    Source: research.ohiiho.com/arsenal/alfa3/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_alfa_v4_tesla {
    meta:
        description = "Alfa Shell V4 Tesla (anchors on Alfa-specific markers; the shared Hmei7 beacon is covered by webshell_hmei7_beacon)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/alfa-v4-tesla/"
        status      = "validated"
        sha256_alfa3        = "6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306"
        sha256_alfav4_tesla = "85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90"

    strings:
        $alfa_title    = "Alfa Shell" ascii nocase
        $alfa_team     = "Alfa_Team" ascii
        $solevisible   = "solevisible" ascii
        $config_global = "$GLOBALS['OWtTcBmdOd']" ascii
        $tujan_mail    = "$tujuanmail" ascii
        $pesan_alert   = "$pesan_alert" ascii
        $create_fn     = "create_function" ascii
        $eval_b64      = "eval(base64_decode(" ascii

    condition:
        filesize < 300KB
        and (
            // source-form shell: an Alfa marker together with a PHP code marker
            // (the AND excludes Alfa readme/notes .txt that merely name the shell)
            (($alfa_title or $alfa_team or $solevisible or ($tujan_mail and $pesan_alert))
                and ($create_fn or $eval_b64))
            // alfa3 packed instance — unique obfuscated global
            or $config_global
            // opaque packed instances — no usable plaintext signature, hash-anchored
            // (filesize == guard so the SHA256 is computed only for the exact candidate)
            or (filesize == 252175 and hash.sha256(0, filesize) == "6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306")
            or (filesize == 167465 and hash.sha256(0, filesize) == "85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90")
        )
}