/*
    Source: research.ohiiho.com/arsenal/shell-checker/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_shell_checker {
    meta:
        description = "shell-checker (selmasker) — disguised webshell validator (JExCoders)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/shell-checker/"
        status      = "validated"

    strings:
        $selmasker  = "selmasker" ascii nocase
        $jexcoders  = "JExCoders" ascii nocase
        $xploitsec  = "XploitSec" ascii nocase
        $version    = "Webshell Mass Checker 1.0" ascii
        $b64_decode = "base64_decode" ascii
        $ua_qt      = "QtWebEngine" ascii
        $upload_b64 = "bW92ZV91cGxvYWRlZF9maWxl" ascii
        $shell_mail = "Ada shell masuk" ascii

    condition:
        filesize < 15KB
        and ($selmasker or $jexcoders or $xploitsec or $version or $shell_mail or $ua_qt)
        and ($b64_decode or $upload_b64)
}