MacOS_Backdoor_Applejeus_0152671e

rule MacOS_Backdoor_Applejeus_0152671e {
    meta:
        author = "Elastic Security"
        id = "0152671e-1086-4776-a3ac-87ad6e5d5dcf"
        fingerprint = "4207620255ab5bbb3ebe27d790e282a24987505c42a1876c8092370ee564712c"
        creation_date = "2026-02-27"
        last_modified = "2026-04-06"
        threat_name = "MacOS.Backdoor.Applejeus"
        reference_sample = "5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a = "--jeus" fullword
        $b = "%09d-%06d" fullword
        $c = "Reply received"
        $d = "multipart/form-data;boundary=jeus" fullword
    condition:
        all of them
}