rule Linux_Ransomware_Packer
{
    meta:
        description = "Packer tipici usati dai ransomware Linux"
        author = "BastionGuard"
        fix_notes = "FP fix: i pattern $crypt1/$crypt2 sono sequenze x86-64 generiche - limitati a filesize < 5MB per ridurre FP su binari di sistema"

    strings:
        $upx0 = "UPX!" ascii
        $crypt1 = { 48 8B ?? ?? 48 8B ?? ?? E8 ?? ?? ?? ?? 48 89 }
        $crypt2 = { E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 }

    condition:
        uint32(0) == 0x7f454c46 and
        ($upx0 or (1 of ($crypt*) and filesize < 5MB))
}