Omegatech EtherHiding
ClickFix V10

rule SecureLeaf_Omegatech_V10_CSharp_Loader {
  meta:
    description = "Omegatech ClickFix C# P/Invoke shellcode loader stub - V8/V9/V10 (Tier-1 dev fingerprint)"
    author      = "SecureLeaf / Dispensight"
    date        = "2026-06-15"
    reference   = "SL-ADV-2026-WP-001-V10"
  strings:
    $va     = "VirtualAlloc(IntPtr a, uint sz, uint t, uint p)" ascii
    $ct     = "CreateThread(IntPtr ta, uint ss, IntPtr sa, IntPtr p, uint cf" ascii
    $wfso   = "WaitForSingleObject(IntPtr h, uint ms)" ascii
    $interop= "System.Runtime.InteropServices" ascii
    $kernel = "kernel32.dll" ascii
    $tid    = "out uint tid" ascii  // V8 + V10
    $sid    = "out uint sid" ascii  // V9
  condition:
    $interop and $kernel and $va and $ct and $wfso and ($tid or $sid)
}

rule SecureLeaf_Omegatech_EtherHiding_Contract {
  meta:
    description = "Omegatech EtherHiding BSC-testnet payload-pointer contract (eth_call) - stable across V8/V9/V10"
    author      = "SecureLeaf / Dispensight"
    date        = "2026-06-15"
    reference   = "SL-ADV-2026-WP-001-V10"
  strings:
    $contract = "0x7Fd85c090f2b35071C57a3b9FeAF462aaEb0E437" ascii nocase
    $selector = "0x6d4ce63c" ascii
    $ethcall  = "eth_call" ascii
    $rpc1     = "bsc-testnet-rpc.publicnode.com" ascii
    $rpc2     = "bnbchain.org" ascii
    $allfail  = "All RPC nodes failed" ascii
  condition:
    ($contract or $selector) and $ethcall and ($rpc1 or $rpc2 or $allfail)
}

rule SecureLeaf_Omegatech_Payload_URL_V8V10 {
  meta:
    description = "Omegatech payload staging URL - path prefix survives V8/V9/V10 naming rotation"
    author      = "SecureLeaf / Dispensight"
    date        = "2026-06-15"
  strings:
    $path    = "/x7GkP2mQ9zL4/" ascii
    $my      = "my_"      ascii  // V8, V10
    $student = "student_" ascii  // V9
    $bin     = ".bin"     ascii
    $png     = ".png"     ascii
  condition:
    $path and ($my or $student) and ($bin or $png)
}