rule Spider_IoT_Bot_MultiMarker
{
    meta:
        author = "Beelzebub Labs"
        date = "2026-09-23"
        last_tested = "2026-10-01"
        description = "Recovered decoder, string-table, and socket-row markers from Spider IoT bot builds"
        reference_sha256 = "db75a8ddcdbf6eaf388c1753af4baaddc2e9c32fe28523a8c57f331c93206b2f"
        scope = "MIPS, MIPSel, x86_64, and PowerPC samples matched; broader coverage and false positives unknown"
        status = "Candidate; compiled and matched against four samples with YARA 4.5.4"

    strings:
        $chacha_key = { 3f 96 ec c3 2b ac 3b 5e b2 3d 89 99 d4 0d f2 c8
                        ca 41 0f ba 45 ae f1 a9 e6 fc 94 f6 c6 4b 97 5d }
        $chacha_nonce = { 6e 50 95 b7 c0 f5 1b a7 ff 3f 9f 37 }
        $xor_key = { d4 7b 04 3d 92 80 6b 13 c1 81 5b 41
                     d3 c4 52 fc c2 7b 3e 32 9b 67 db f0 }
        $spider_name = { 87 2b 4d 79 d7 d2 34 5d 80 cc 1e }
        $spider_ps = { 87 2b 4d 79 d7 d2 34 43 92 }
        $spider_install = { 87 2b 4d 79 d7 d2 34 5a 8f d2 0f 00 9f 88 }
        $kill_socket_row = " %*d: %*s %63s %15s %*s %*s %*s %*s %*s %lu" ascii

    condition:
        uint32(0) == 0x464c457f and
        2 of ($chacha_key, $chacha_nonce, $xor_key) and
        2 of ($spider_name, $spider_ps, $spider_install) and
        $kill_socket_row
}