rule elf_persirai_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects elf.persirai."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a01 50 89d0 c1e810 25ff000000 }
            // n = 5, score = 100
            //   6a01                 | push                1
            //   50                   | push                eax
            //   89d0                 | mov                 eax, edx
            //   c1e810               | shr                 eax, 0x10
            //   25ff000000           | and                 eax, 0xff

        $sequence_1 = { 6a00 68b80b0000 56 52 e8???????? 83c410 89c2 }
            // n = 7, score = 100
            //   6a00                 | push                0
            //   68b80b0000           | push                0xbb8
            //   56                   | push                esi
            //   52                   | push                edx
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10
            //   89c2                 | mov                 edx, eax

        $sequence_2 = { 8b5104 8d44241c 50 51 ff5204 83c410 eb29 }
            // n = 7, score = 100
            //   8b5104               | mov                 edx, dword ptr [ecx + 4]
            //   8d44241c             | lea                 eax, [esp + 0x1c]
            //   50                   | push                eax
            //   51                   | push                ecx
            //   ff5204               | call                dword ptr [edx + 4]
            //   83c410               | add                 esp, 0x10
            //   eb29                 | jmp                 0x2b

        $sequence_3 = { 5e c3 53 81eca8000000 a1???????? }
            // n = 5, score = 100
            //   5e                   | pop                 esi
            //   c3                   | ret                 
            //   53                   | push                ebx
            //   81eca8000000         | sub                 esp, 0xa8
            //   a1????????           |                     

        $sequence_4 = { eb28 83ec0c 68???????? e8???????? c70424???????? e8???????? e8???????? }
            // n = 7, score = 100
            //   eb28                 | jmp                 0x2a
            //   83ec0c               | sub                 esp, 0xc
            //   68????????           |                     
            //   e8????????           |                     
            //   c70424????????       |                     
            //   e8????????           |                     
            //   e8????????           |                     

        $sequence_5 = { 75ec 8b86c4010000 eb10 83ec0c 8b18 50 }
            // n = 6, score = 100
            //   75ec                 | jne                 0xffffffee
            //   8b86c4010000         | mov                 eax, dword ptr [esi + 0x1c4]
            //   eb10                 | jmp                 0x12
            //   83ec0c               | sub                 esp, 0xc
            //   8b18                 | mov                 ebx, dword ptr [eax]
            //   50                   | push                eax

        $sequence_6 = { 8b442410 83c804 89442410 8a16 46 eba4 8a16 }
            // n = 7, score = 100
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   83c804               | or                  eax, 4
            //   89442410             | mov                 dword ptr [esp + 0x10], eax
            //   8a16                 | mov                 dl, byte ptr [esi]
            //   46                   | inc                 esi
            //   eba4                 | jmp                 0xffffffa6
            //   8a16                 | mov                 dl, byte ptr [esi]

        $sequence_7 = { 76df 807c242111 75d8 668b44242e 66c1c808 6683f835 75c9 }
            // n = 7, score = 100
            //   76df                 | jbe                 0xffffffe1
            //   807c242111           | cmp                 byte ptr [esp + 0x21], 0x11
            //   75d8                 | jne                 0xffffffda
            //   668b44242e           | mov                 ax, word ptr [esp + 0x2e]
            //   66c1c808             | ror                 ax, 8
            //   6683f835             | cmp                 ax, 0x35
            //   75c9                 | jne                 0xffffffcb

        $sequence_8 = { 52 52 8b00 50 68???????? e8???????? 81c4dc1a0000 }
            // n = 7, score = 100
            //   52                   | push                edx
            //   52                   | push                edx
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   50                   | push                eax
            //   68????????           |                     
            //   e8????????           |                     
            //   81c4dc1a0000         | add                 esp, 0x1adc

        $sequence_9 = { 5d ffe1 83c40c 31c0 5b 5e }
            // n = 6, score = 100
            //   5d                   | pop                 ebp
            //   ffe1                 | jmp                 ecx
            //   83c40c               | add                 esp, 0xc
            //   31c0                 | xor                 eax, eax
            //   5b                   | pop                 ebx
            //   5e                   | pop                 esi

    condition:
        7 of them and filesize < 229376
}

rule elf_persirai_w0 {
    meta:
        description = "Detects Persirai Botnet Malware"
        soure = "http://blog.trendmicro.com/trendlabs-security-intelligence/persirai-new-internet-things-iot-botnet-targets-ip-cameras/"
        author = "Tim Yeh"
        reference = "Internal Research"
        date = "2017-04-21"
        hash = "f736948bb4575c10a3175f0078a2b5d36cce1aa4cd635307d03c826e305a7489"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai"
        malpedia_version = "20170509"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $x1 = "ftpupload.sh" fullword ascii
        $x2 = "/dev/misc/watchdog" fullword ascii
        $x3 = "/dev/watchdog" ascii
        $x4 = ":52869/picsdesc.xml" fullword ascii
        $x5 = "npxXoudifFeEgGaACScs" fullword ascii

        $s1 = "ftptest.cgi" fullword ascii
        $s2 = "set_ftp.cgi" fullword ascii
        $s3 = "2580e538f3723927f1ea2fdb8d57b99e9cc37ced1" fullword ascii
        $s4 = "023ea8c671c0abf77241886465200cf81b1a2bf5e" fullword ascii

    condition:
        uint16(0) == 0x457f and filesize < 300KB and ((1 of ($x*) and 1 of ($s*)) or 2 of ($s*))
}