import "hash"

rule ogurexxx_d70f917e35813a7a
{
    meta:
        description = "File dropped in the ogurexxx.ru SSH honeypot"
        sha256 = "d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141"
        date = "2026-10-31"
    condition:
        hash.sha256(0, filesize) == "d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141"
}