/*
    Source: research.ohiiho.com/arsenal/viper/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_viper_uploader {
    meta:
        description = "viper.php uploader with Hmei7 supply-chain beacon (Viper 1337)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/viper/"
        status      = "validated"

    strings:
        $viper_title = "Viper 1337" ascii
        $viper_bot   = "Viper 1337 Bot" ascii
        $gif89a      = "GIF89a" ascii
        $eval_b64    = "eval(base64_decode(" ascii
        $hmei7_b64   = "JHR1anVhbm1haWwgPSAnS2VsdWFyZ2FIbWVpN0B5YW5kZXguY29t" ascii
        $copy_upload = "@copy($_FILES['file']['tmp_name']" ascii
        $upl_button  = "_upl=Upload" ascii

    condition:
        filesize < 2KB
        and ($viper_title or $viper_bot)
        and ($eval_b64 or $hmei7_b64 or $copy_upload or $gif89a or $upl_button)
}