/*
    Source: research.ohiiho.com/arsenal/stupidc0de/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_stupidc0de {
    meta:
        description = "Stupidc0de Backdoor (Indonesian scene, 90KB full-featured)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/stupidc0de/"
        status      = "validated"

    strings:
        $title      = "Stupidc0de" ascii
        $family     = "Stupidc0de Family" ascii
        $author1    = "Putra-Attacker" ascii
        $author2    = "Daryun" ascii
        $author3    = "Shor7cut" ascii
        $author4    = "Sinkaroid" ascii
        $email      = "puputsc48@gmail.com" ascii
        $html_title = "-:- Backdoor -:-" ascii
        $css_class  = "class='coeg'" ascii
        $conf_dir   = "Stupidc0de-Conf" ascii

    condition:
        filesize < 120KB
        and ($title or $family or $html_title or $conf_dir)
        and ($author1 or $author2 or $author3 or $author4 or $email or $css_class)
}