SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation

rule SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation {
   meta:
   description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
   author = "netadr, modified by Florian Roth to avoid elf module import"
   reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
   date = "2023-04-02"
   modified = "2023-05-08"
   score = 60

   id = "15ee9a66-d823-508c-a14c-2c6ff45f47e5"
   strings:
      // xor g3, 0x47, o5
      // xor o5, g1, o5
      // xor g2, o5, o5
      $xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }

      $a1 = "SUNW_"

   condition:
      uint32be(0) == 0x7f454c46
      and $a1
      and $xor_block
}