/*
    Source: research.ohiiho.com/arsenal/c99/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_c99 {
    meta:
        description = "c99 webshell (Locus7 / physx variant)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/c99/"
        status      = "validated"

    strings:
        $title1       = "c99shell" ascii nocase
        $title2       = "Locus7Shell" ascii
        $bind_port    = "Port alredy in use" ascii
        $datapipe     = "$datapipe[\"port\"]" ascii
        $fsock        = "fsockopen(\"localhost\",$bind" ascii
        $anypass      = "$anypass" ascii
        $anyphp       = "$anyphpcode" ascii
        $md5chain     = "md5(sha1(md5($anypass)))" ascii
        $disablefunc  = "$disablefunc" ascii
        $cfe_var      = "@shell_exec($cfe)" ascii
        $magic_byte   = "$data{0}