rule GrayRabbit_Backdoor_Sogou_Exploit {
  meta:
    author = "Tia N. List"
    date = "2026-09-14"
    status = "experimental"
    description = "Detects GrayRabbit backdoor deployed via CVE-2026-51990 exploitation of Tencent Sogou Input Method"
    reference = "https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/"
    falsepositives = "None known"
    hash_loader = "29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63"
    hash_payload = "749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e"
    hash_binary = "d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a"

  strings:
    $c2_domain = "mail.uaiubifas" ascii nocase
    $sogou_path = "\\SGMyInput.exe" ascii
    $skincenter = "skincenter" ascii
    $gbiz_uri = "sgbiz:" ascii
    $public_docs = "C:\\Users\\Public\\Documents" ascii
    $7z_dll = "7z.dll" ascii
    $ntfs_ads = "NTFS" ascii
    $ntfs_delete = ":$DATA" ascii

  condition:
    uint16(0) == 0x5A4D and
    filesize < 5MB and
    3 of ($c2_domain, $sogou_path, $skincenter, $gbiz_uri, $public_docs, $7z_dll, $ntfs_ads, $ntfs_delete)
}