/*
    Source: research.ohiiho.com/arsenal/unzipper/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_unzipper {
    meta:
        description = "Unzipper utility carrying the W0rm supply-chain injection (base64 form; VT 0/62)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/unzipper/"

    strings:
        $title    = "unzipper" ascii nocase
        $ziparch  = "ZipArchive" ascii
        $extract  = "extractTo" ascii
        $w0rm_log    = "errors_log" ascii
        $w0rm_b64pb  = "aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3" ascii
        $w0rm_cmd    = "$_GET[\"cmd\"]" ascii
        $w0rm_pb     = "pastebin.com/raw/" ascii

    condition:
        filesize < 20KB
        and ($title or ($ziparch and $extract))
        and ($w0rm_log or $w0rm_b64pb or $w0rm_cmd or $w0rm_pb)
}