/*
    Source: research.ohiiho.com/arsenal/b374k/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_b374k {
    meta:
        description = "b374k webshell v3.x (source or packed)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/b374k/"
        status      = "validated"

    strings:
        $title     = "b374k" ascii nocase
        $packer    = "gzinflate(base64_decode(" ascii
        $auth      = "sha1(md5($" ascii
        $res       = "$GLOBALS['resources']" ascii
        $ua_check  = "HTTP_USER_AGENT" ascii
        $ua_bot1   = "\"curl\"" ascii
        $ua_bot2   = "\"wget\"" ascii
        $ua_bot3   = "\"python\"" ascii
        $ua_bot4   = "\"spider\"" ascii
        $proc_open = "proc_open($code" ascii
        $fsock     = "fsockopen($packetHost" ascii

    condition:
        filesize < 300KB and $title
        and ($packer
             or $res or $proc_open or $fsock
             or ($ua_check and 2 of ($ua_bot*))
             or $auth)
}