/*
    Source: research.ohiiho.com/reports/2026-05-sorry-worm-playbook/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule SorryWorm_Binary_StringIndicators : ohiiho sorry_worm linux ransomware
{
    meta:
        author      = "OHIIHO Research"
        date        = "2026-05-01"
        description = "Detects the Sorry-worm Linux ransomware-worm hybrid binary by characteristic strings."
        sample_sha256 = "2fc0a056fd4eff5d31d06c103af3298d711f33dbcd5d122cae30b571ac511e5a"
        reference   = "https://research.ohiiho.com/part-2-sorry-worm-anatomy"
        license     = "CC0-1.0"

    strings:
        $sorry_id_str   = "Sorry-ID" ascii
        $qtox_repo      = "github.com/qTox/qTox" ascii
        $taobao_str     = "taobao.com" ascii
        $marker_lock    = "/tmp/Sorry.lock" ascii
        $marker_exist   = "/tmp/.sorry_exist" ascii
        $marker_id_pfx  = "sorry_id_" ascii
        $log_template   = ".sorry_%s.log" ascii
        $err_killdb     = "error killing database processes" ascii
        $ssh_success    = "[+] SUCCESS %s:%d user=%s pass=%s" ascii

    condition:
        uint32(0) == 0x464C457F
        and filesize > 4MB and filesize < 8MB
        and 5 of them
}