n4d_agent_packed

rule n4d_agent_packed {
    meta:
        description = "n4d MCP propagation agent (UPX-packed, garble-obfuscated)"
        author      = "Deception Fleet"
        date        = "2026-07-15"
        hash        = "fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482"
    strings:
        $upx = "UPX!"
        $go_buildinf = "Go buildinf:"
        $upx_meta = { 55 50 58 21 4C 0C 0E 16 }
    condition:
        uint32(0) == 0x464C457F and
        filesize > 5MB and filesize < 25MB and
        $upx and ($go_buildinf or $upx_meta)
}