/*
    Source: research.ohiiho.com/arsenal/smtpfu-ker/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_smtpfuker {
    meta:
        description = "smtpfu*ker SMTP brute-force (PHPJiaMi-packed)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/smtpfu-ker/"

    strings:
        $phpjiami1 = "phpjiami" ascii nocase
        $phpjiami2 = "PHPJiaMi" ascii

    condition:
        filesize < 30KB
        and ($phpjiami1 or $phpjiami2)
}