import "hash"

rule ogurexxx_d7f98e379c400c13
{
    meta:
        description = "File dropped in the ogurexxx.ru SSH honeypot"
        sha256 = "d7f98e379c400c13340781ccb65017c000330824ea26680866b9d3e43d641721"
        date = "2026-10-31"
    condition:
        hash.sha256(0, filesize) == "d7f98e379c400c13340781ccb65017c000330824ea26680866b9d3e43d641721"
}