import "hash"

rule ogurexxx_3f3a11bafabb1a35
{
    meta:
        description = "File dropped in the ogurexxx.ru SSH honeypot"
        sha256 = "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892"
        date = "2026-10-31"
    strings:
        $s0 = "crontab" nocase
        $s1 = "wget" nocase
    condition:
        hash.sha256(0, filesize) == "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892" or
        (filesize < 3KB and all of ($s*))
}