/*
    Hydra Bot v5 — Redis RCE Cryptomining Toolkit
    Detection rules for the stager and C2 agent binary.
    Reference: research.ohiiho.com
    Date: 2026-09-01
    License: Free to use with attribution.
*/

rule HYDRA_BOT_V5_STAGER
{
    meta:
        description = "Detects Hydra Bot v5 stager script (ha-fixed.sh)"
        author = "OHIIHO Research"
        date = "2026-09-01"
        hash = "50540a594356f5fdbdf8d4cca48f4ee72c7316eae7ed61eb3ba7eb86b79d1706"
        reference = "research.ohiiho.com"
        severity = "high"

    strings:
        $banner = "Hydra Bot v5" ascii
        $wallet_prefix = "49XtZV5Zis31" ascii
        $hostname1 = "kasemaster.es" ascii
        $hostname2 = "kasemaster" ascii
        $c2_ip = "152.89.236.100" ascii
        $onion = ".onion" ascii
        $fetch_func = "fetch()" ascii wide
        $competitor_kill = "killall -9 xmrig" ascii
        $persistence_dir = "/var/lib/systemd/.cache" ascii
        $dev_tcp = "/dev/tcp/" ascii
        $c2_port = ":31337" ascii
        $pool = "moneroocean" ascii

    condition:
        filesize < 10KB and
        $banner and
        (
            ($wallet_prefix and $c2_ip) or
            ($hostname1 and $onion) or
            ($persistence_dir and $competitor_kill and $dev_tcp)
        )
}

rule HYDRA_BOT_V5_AGENT
{
    meta:
        description = "Detects Hydra Bot v5 C2 agent binary (mini-agent-v2)"
        author = "OHIIHO Research"
        date = "2026-09-01"
        hash = "a505de0af54408dcde2f869608398a409908543a43fad15397a342b2200f8a52"
        reference = "research.ohiiho.com"
        severity = "high"

    strings:
        $elf_magic = { 7F 45 4C 46 }
        $crypto1 = "AES-NI GCM" ascii
        $crypto2 = "X25519" ascii
        $crypto3 = "CRYPTOGAMS" ascii
        $crypto4 = "expand 32" ascii
        $tokio = "TOKIO_WORKER" ascii
        $async = "async-io" ascii
        $hamburg = "Mike Hambur" ascii
        $keccak = "-1600 absorb" ascii
        $ssh_hint = "ssh-userH" ascii

    condition:
        $elf_magic at 0 and
        filesize > 3500KB and filesize < 4200KB and
        3 of ($crypto1, $crypto2, $crypto3, $crypto4, $hamburg, $keccak) and
        ($tokio or $async)
}