/*
   Linux/Kinsing Go ELF bot (SystemTen case, Dec 2019 - Feb 2020)
   Author : @unixfreaxjp / MalwareMustDie
   Ref    : MMD blog post "Linux/Kinsing" (MMD-00xx-2026)
   Notes  : Strings are taken from the reversing notes of this case
            (main.* function names recovered from .gopclntab, Go libraries
            in .rodata/.gopclntab, hardcoded C2 string, embedded paths).
            The pkger-embedded miner and scripts are encoded inside the binary,
            so their decoded strings (e.g. "XMRig", "/home/nook/...") are NOT used here.
   TLP    : CLEAR
*/

import "hash"

rule MMD_Linux_Kinsing_Bot_Hash
{
    meta:
        description = "Linux/Kinsing Go ELF bot - exact sample hashes from the MMD analysis"
        author      = "unixfreaxjp / MalwareMustDie"
        date        = "2026-11-12"
        family      = "Kinsing / H2Miner"
        confidence  = "high"
        md5         = "6bffa50350be7234071814181277ae79"
        sha1        = "2cb455f23b352e27b1f2f60abd61b444d15fafb0"

    condition:
        uint32(0) == 0x464c457f and
        hash.md5(0, filesize) == "6bffa50350be7234071814181277ae79"
}

rule MMD_Linux_Kinsing_Bot_Go_Family
{
    meta:
        description = "Linux/Kinsing Go ELF bot - family rule based on main.* function names and its Go library set"
        author      = "unixfreaxjp / MalwareMustDie"
        date        = "2026-11-12"
        family      = "Kinsing / H2Miner"
        confidence  = "high"
        reference   = "MMD analysis: Full list of kinsing main functions, Go libraries used by kinsing"

    strings:
        // original main.* functions (survive stripping in .gopclntab)
        $f01 = "main.redisBrute"                    ascii
        $f02 = "main.backconnect"                   ascii
        $f03 = "main.masscan"                       ascii
        $f04 = "main.minRun"                        ascii
        $f05 = "main.getMinerPid"                   ascii
        $f06 = "main.isMinerRunning"                ascii
        $f07 = "main.minerRunningCheck"             ascii
        $f08 = "main.sendMinerPid"                  ascii
        $f09 = "main.runTaskWithHttp"               ascii
        $f10 = "main.runTaskWithScan"               ascii
        $f11 = "main.taskWithScanWorker"            ascii
        $f12 = "main.taskWithHttpWorker"            ascii
        $f13 = "main.doRequestWithTooManyOpenFiles" ascii
        $f14 = "main.getOrCreateUuid"               ascii
        $f15 = "main.startCmdWithOutputSingle"      ascii
        $f16 = "main.downloadAndExecute"            ascii
        $f17 = "main.getWriteableDir"               ascii
        $f18 = "main.connectForSocks"               ascii
        $f19 = "main.healthChecker"                 ascii
        $f20 = "main.execTaskOut"                   ascii

        // Go libraries identified in the binary
        $l1 = "github.com/markbates/pkger"          ascii
        $l2 = "github.com/armon/go-socks5"          ascii
        $l3 = "github.com/hashicorp/yamux"          ascii
        $l4 = "github.com/paulbellamy/ratecounter"  ascii
        $l5 = "github.com/peterbourgon/diskv"       ascii
        $l6 = "github.com/nu7hatch/gouuid"          ascii
        $l7 = "github.com/go-resty/resty"           ascii
        $l8 = "github.com/shirou/gopsutil"          ascii
        $l9 = "github.com/kelseyhightower/envconfig" ascii

    condition:
        uint32(0) == 0x464c457f and
        filesize > 3MB and filesize < 40MB and
        8 of ($f*) and
        3 of ($l*)
}

rule MMD_Linux_Kinsing_Bot_Case_2020
{
    meta:
        description = "Linux/Kinsing Go ELF bot - case-specific build (hardcoded C2 list, work paths, Redis AUTH logic)"
        author      = "unixfreaxjp / MalwareMustDie"
        date        = "2026-11-12"
        family      = "Kinsing / H2Miner"
        confidence  = "high (this build), low for later builds"

    strings:
        // hardcoded C2 list, packed as one string separated by ";http://"
        $c1 = "45.10.88.102;http://91.215.169.111" ascii
        $c2 = "139.99.50.255;http://46.243.253.167" ascii
        $c3 = "195.123.220.193" ascii

        // work paths seen during the infection
        $p1 = ".ICEd-unix"      ascii
        $p2 = "kdevtmpfsi"      ascii
        $p3 = "linux.lock"      ascii

        // Redis AUTH brute reply check (glued Go string, see r2 listing)
        $r1 = "Client sent AUTH, but no password is set" ascii

        // C2 task type seen in the decrypted command
        $t1 = "download_and_exec" ascii

    condition:
        uint32(0) == 0x464c457f and
        filesize < 40MB and
        (
            ( 1 of ($c1, $c2) and 1 of ($p*) ) or
            ( $c3 and 2 of ($p*) and ($r1 or $t1) )
        )
}