id: macos-bella-malware

info:
  name: Bella Malware - Detect
  author: daffainfo
  severity: info
  reference:
    - https://github.com/airbnb/binaryalert/blob/master/rules/public/malware/macos/malware_macos_bella.yara
  tags: malware,file,macos-bella
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: word
        part: raw
        words:
          - "Verified! [2FV Enabled] Account ->"
          - "There is no root shell to perform this command. See [rooter] manual entry."
          - "Attempt to escalate Bella to root through a variety of attack vectors."
          - "BELLA IS NOW RUNNING. CONNECT TO BELLA FROM THE CONTROL CENTER."
        condition: or

      - type: word
        part: raw
        words:
          - "user_pass_phish"
          - "bella_info"
          - "get_root"
        condition: and

      - type: word
        part: raw
        words:
          - "Please specify a bella server."
          - "What port should Bella connect on [Default is 4545]:"
        condition: and
# digest: 4a0a0047304502207e88334f62e74a50da834e894a851cb84a5f39ad83be9986703ae6d728f1e71c022100f090521b5d2ab310928f0f275adbc9cdbea1e070f9849988a3a4b47aa090d20f:922c64590222798bb761d5b6d8e72950