rule Midnight_Mimosa_Firmware_Implant {
    meta:
        author = "Tia N. List"
        date = "2026-10-09"
        status = "experimental"
        description = "Midnight Mimosa platform-signed system application preinstalled in low-cost MediaTek Android firmware; rotating package names and a weather-API C2 hostname documented by Bitdefender. Derived from case analysis — NOT validated against a live sample."
        reference = "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
        falsepositives = "Benign system packages share the com.android prefix; require two package-name hits or one package name plus the C2 hostname before acting"
    strings:
        $pkg1 = "com.android.system.lite" ascii nocase
        $pkg2 = "com.android.sys.prot" ascii nocase
        $pkg3 = "com.android.sys.gmsprot" ascii nocase
        $pkg4 = "com.android.sys.bcprot" ascii nocase
        $c2 = "api.weatherlive.world" ascii nocase
    condition:
        2 of ($pkg*) or ($c2 and 1 of ($pkg*))
}