rule LINUX_ELF_TOOL_OPHCRACK_RELATED
{
  meta:
    author = "defensive"
    description = "Linux ELF: Ophcrack-related binaries by strings"
    severity = "high"
    fix_notes = "BUG FIX CRITICO: magic byte era 0x464C457F (big-endian errato) - su x86/x86-64 uint32(0) legge little-endian, il valore corretto e' 0x7f454c46. La regola originale non matchava alcun ELF reale."

  strings:
    $k1 = "ophcrack" nocase ascii
    $k2 = "load tables" nocase ascii
    $k3 = "tables" nocase ascii
    $k4 = "LM" fullword ascii
    $k5 = "NTLM" fullword ascii
    $k6 = "SAM" ascii

  condition:
    uint32(0) == 0x7f454c46 and
    $k1 and 2 of ($k2,$k3,$k4,$k5,$k6) and
    filesize < 200MB
}