/*
    Source: research.ohiiho.com/arsenal/mysql-interface/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_mysql_interface {
    meta:
        description = "MySQL-interface web admin with W0rm supply-chain backdoor (tryag_vb variant)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/mysql-interface/"
        status      = "validated"

    strings:
        $extract    = "extract($HTTP_POST_VARS)" ascii
        $cred_user  = "tryag_vb" ascii
        $cred_pass  = "102030" ascii
        $mysql_q    = "mysql_query" ascii
        $mysql_conn = "mysql_connect" ascii

    condition:
        filesize < 60KB
        and ($extract or ($cred_user and $cred_pass))
        and ($mysql_q or $mysql_conn)
}