/*
    Source: research.ohiiho.com/arsenal/mails-grabber/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_mails_grabber {
    meta:
        description = "mails_grabber database email harvester (SparkyDz / G-B)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/mails-grabber/"

    strings:
        $sparkydz   = "SparkyDz" ascii nocase
        $gb_author  = "G-B" ascii
        $mysql_q    = "mysql_query" ascii
        $show_db    = "SHOW DATABASES" ascii
        $show_tbl   = "SHOW TABLES" ascii
        $regex_mail = "[a-z0-9._%+-]+@[a-z0-9.-]" ascii

    condition:
        filesize < 20KB
        and ($sparkydz or $gb_author)
        and $mysql_q
        and ($show_db or $show_tbl or $regex_mail)
}