/*
    Source: research.ohiiho.com/arsenal/flashx-uploaders/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_flashx_pastebin_beacon {
    meta:
        description = "Flash-X/XPROAD pastebin-sourced mail beacon (eval+base64 exfil block)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/flashx-uploaders/"
        status      = "validated"

    strings:
        $eval_b64   = "eval (base64_decode(" ascii
        $xproad_b64 = "JGVtYWlsID0gInhwcm9hZGhtaWRhQHlhaG9vLmNvbSI7" ascii  // b64 '$email = "xproadhmida@yahoo.com";'
        $remote_b64 = "JGlwID0gZ2V0ZW52KCJSRU1PVEVfQUREUiIp" ascii        // b64 '$ip = getenv("REMOTE_ADDR")'
        $xproad     = "xproadhmida" ascii
        $bazooka    = "BAZOOKA" ascii

    condition:
        filesize < 3KB
        and $eval_b64
        and ($xproad_b64 or $remote_b64 or $xproad or $bazooka)
}