EtherHiding: Fake Google Drive Offline Extension Configured On-Chain

Node running from a cache directory or the campaign hosts and identifiers are the strong signals, and persistence or hash hits alone need the process behind them read.

union
    // optional: lower fidelity, only a secondary report states that the extension is patched into Secure Preferences and Chrome helper process names vary; delete this line and the branch below it
    (DeviceFileEvents
        | where Timestamp > ago(30d) and ActionType in ("FileCreated", "FileModified", "FileRenamed")
        | where FileName =~ "Secure Preferences" and not(InitiatingProcessFileName startswith "Google Chrome")
        | project Timestamp, DeviceId, DeviceName, Signal = "extension sideload", Detail = strcat(FolderPath, "/", FileName, " by ", InitiatingProcessFileName)),
    // optional: lower fidelity, the report names no file for the launch agent or the .zshrc line, so legitimate installers and developer tools also match; delete this line and the branch below it
    (DeviceFileEvents
        | where Timestamp > ago(30d) and ActionType in ("FileCreated", "FileModified", "FileRenamed")
        | where InitiatingProcessFileName in~ ("node", "sh", "bash", "zsh", "curl")
        | where FolderPath contains "/Library/LaunchAgents" or FileName =~ ".zshrc"
        | project Timestamp, DeviceId, DeviceName, Signal = "persistence", Detail = strcat(FolderPath, "/", FileName, " by ", InitiatingProcessFileName)),
    // optional: lower fidelity, the three hashes are single builds and a rebuild changes them; delete this line and the branch below it
    (DeviceFileEvents
        | where Timestamp > ago(90d) and SHA256 in ("370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50")
        | project Timestamp, DeviceId, DeviceName, Signal = "reported hash", Detail = strcat(FolderPath, "/", FileName)),
    (DeviceNetworkEvents
        | where Timestamp > ago(90d)
        | where RemoteUrl has_any ("real-tumble.pro", "th-updates.sbs", "rg-telemetry.sbs") or RemoteUrl has_any ("0x85a6d913aac80286f01fa082ef0b96c188673043", "0x2aca749b59529f5cbcd6fbd34b35b1a546713df6", "0x3bc5de30", "0x277765fb63601ce5a9814daf68aa2a57f54ea968", "0x89c5151236de544d077fc69813a4db89224ee8a1", "0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192", "0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2", "xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf")
            // optional: lower fidelity, eth-mainnet.rpcfast.com is a legitimate RPC service and only the API key is the indicator; delete this line and the next
            or RemoteUrl has "eth-mainnet.rpcfast.com"
        | project Timestamp, DeviceId, DeviceName, Signal = "network", Detail = strcat(InitiatingProcessFileName, " -> ", RemoteUrl)),
    (DeviceProcessEvents
        | where Timestamp > ago(30d)
        | where (FileName =~ "node" and (FolderPath contains "/Library/Caches/" or ProcessCommandLine contains "/Library/Caches/"))
            or ProcessCommandLine contains "NODE_TLS_REJECT_UNAUTHORIZED=0"
            or ProcessCommandLine has_any ("0x85a6d913aac80286f01fa082ef0b96c188673043", "0x2aca749b59529f5cbcd6fbd34b35b1a546713df6", "0x3bc5de30", "0x277765fb63601ce5a9814daf68aa2a57f54ea968", "0x89c5151236de544d077fc69813a4db89224ee8a1", "0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192", "0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2", "xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf")
        | project Timestamp, DeviceId, DeviceName, Signal = "process", Detail = ProcessCommandLine)
| summarize Hits = count(), Signals = make_set(Signal), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Details = make_set(Detail, 5) by DeviceId, DeviceName
| order by array_length(Signals) desc, LastSeen desc

The same process, persistence, hash and network signals over the Endpoint data model and proxy logs.

```Placeholders: the Endpoint data model carries macOS process and file events; index=proxy is the proxy log.```
| tstats count max(_time) AS _time FROM datamodel=Endpoint.Processes WHERE earliest=-30d
    ((Processes.process_name="node" AND Processes.process="*/Library/Caches/*") OR Processes.process="*NODE_TLS_REJECT_UNAUTHORIZED=0*" OR Processes.process="*0x85a6d913aac80286f01fa082ef0b96c188673043*" OR Processes.process="*0x2aca749b59529f5cbcd6fbd34b35b1a546713df6*" OR Processes.process="*0x3bc5de30*" OR Processes.process="*0x277765fb63601ce5a9814daf68aa2a57f54ea968*" OR Processes.process="*0x89c5151236de544d077fc69813a4db89224ee8a1*" OR Processes.process="*0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192*" OR Processes.process="*0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2*" OR Processes.process="*xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf*")
    BY Processes.dest, Processes.process
| rename Processes.dest AS host, Processes.process AS detail
| eval signal="process"
```optional: lower fidelity, the report names no file for the launch agent or the .zshrc line, so legitimate installers and developer tools also match; delete this line and the append block below it```
| append
    [| tstats count max(_time) AS _time FROM datamodel=Endpoint.Filesystem WHERE earliest=-30d (Filesystem.file_path="*/Library/LaunchAgents/*" OR Filesystem.file_name=".zshrc") Filesystem.process_name IN ("node","sh","bash","zsh","curl") BY Filesystem.dest, Filesystem.file_path
     | rename Filesystem.dest AS host, Filesystem.file_path AS detail
     | eval signal="persistence"]
```optional: lower fidelity, only a secondary report states that the extension is patched into Secure Preferences and Chrome helper process names vary; delete this line and the append block below it```
| append
    [| tstats count max(_time) AS _time FROM datamodel=Endpoint.Filesystem WHERE earliest=-30d Filesystem.file_name="Secure Preferences" NOT Filesystem.process_name="Google Chrome*" BY Filesystem.dest, Filesystem.process_name
     | rename Filesystem.dest AS host, Filesystem.process_name AS detail
     | eval signal="extension sideload"]
```optional: lower fidelity, the three hashes are single builds and a rebuild changes them; delete this line and the append block below it```
| append
    [search index=endpoint earliest=-90d file_hash IN ("370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50")
     | stats count max(_time) AS _time values(file_path) AS details BY host
     | eval signal="reported hash"]
| append
    [search index=proxy earliest=-90d (url="*real-tumble.pro*" OR url="*th-updates.sbs*" OR url="*rg-telemetry.sbs*" OR url="*0x85a6d913aac80286f01fa082ef0b96c188673043*" OR url="*0x2aca749b59529f5cbcd6fbd34b35b1a546713df6*" OR url="*0x3bc5de30*" OR url="*0x277765fb63601ce5a9814daf68aa2a57f54ea968*" OR url="*0x89c5151236de544d077fc69813a4db89224ee8a1*" OR url="*0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192*" OR url="*0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2*" OR url="*xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf*"
        ```optional: lower fidelity, eth-mainnet.rpcfast.com is a legitimate RPC service and only the API key is the indicator; delete this line and the next```
        OR url="*eth-mainnet.rpcfast.com*"
     )
     | stats count max(_time) AS _time values(url) AS details BY src
     | eval host=src, signal="network"]
| stats sum(count) AS hits min(_time) AS first_seen max(_time) AS last_seen values(signal) AS signals values(detail) AS details BY host
| eval signal_count=mvcount(signals)
| convert ctime(first_seen) ctime(last_seen)
| sort - signal_count, - last_seen

Three rules that apply to macOS process, file and DNS telemetry.

title: Node.js Backdoor Host Signs from the Fake Google Drive Offline Campaign
id: c0cb412a-0787-4f1b-a518-3744c0349f82
status: experimental
description: >
  Detects the node binary executing from a Library/Caches directory, a
  command line that disables Node.js certificate checking, or one of the
  contract, wallet or API-key identifiers AllSecure lists for the Node.js
  backdoor that reads its configuration from an Ethereum contract.
references:
  - https://cybersecuritynews.com/north-korean-etherhiding-campaign/
logsource:
  category: process_creation
detection:
  sel_node:
    Image|endswith: '/node'
  sel_cache:
    Image|contains: '/Library/Caches/'
  selection_tls:
    CommandLine|contains: 'NODE_TLS_REJECT_UNAUTHORIZED=0'
  selection_ids:
    CommandLine|contains:
      - '0x85a6d913aac80286f01fa082ef0b96c188673043'
      - '0x2aca749b59529f5cbcd6fbd34b35b1a546713df6'
      - '0x3bc5de30'
      - '0x277765fb63601ce5a9814daf68aa2a57f54ea968'
      - '0x89c5151236de544d077fc69813a4db89224ee8a1'
      - '0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192'
      - '0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2'
      - 'xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf'
  # optional: lower fidelity, the three hashes are single builds and a rebuild changes them; delete this line and the selection below it
  selection_hash:
    Hashes|contains:
      - 'SHA256=370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed'
      - 'SHA256=529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795'
      - 'SHA256=7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50'
  condition: (sel_node and sel_cache) or 1 of selection_*
falsepositives:
  - Developer tooling that caches its own Node.js runtime under Library/Caches, and developers who disable certificate checking for a local test
level: high
---
title: Node.js or Shell Writing a Launch Agent or Shell Profile on macOS
id: c0cb412a-0787-4f1b-a518-3744c0349f83
status: experimental
description: >
  Detects node, a shell or curl writing a launch agent or .zshrc, the
  persistence AllSecure describes for the Node.js backdoor.
references:
  - https://cybersecuritynews.com/north-korean-etherhiding-campaign/
logsource:
  category: file_event
detection:
  sel_writer:
    Image|endswith:
      - '/node'
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/curl'
  sel_target:
    TargetFilename|contains: '/Library/LaunchAgents/'
  sel_profile:
    TargetFilename|endswith: '/.zshrc'
  condition: sel_writer and (sel_target or sel_profile)
falsepositives:
  - Legitimate installers and developer tools that write launch agents or edit .zshrc from a shell
level: low
---
title: Lookup of the Fake Google Drive Offline Campaign Infrastructure
id: cab30928-411d-4f1f-9d4c-06c3e17952a2
status: experimental
description: >
  Detects lookups and web requests for the delivery domain and the two
  command-and-control hosts Cyber Security News lists for the EtherHiding
  campaign that installs a malicious Chrome extension named Google Drive
  Offline.
references:
  - https://cybersecuritynews.com/north-korean-etherhiding-campaign/
logsource:
  category: dns_query
detection:
  selection_exact:
    QueryName:
      - 'real-tumble.pro'
      - 'th-updates.sbs'
      - 'rg-telemetry.sbs'
  selection_sub:
    QueryName|endswith:
      - '.real-tumble.pro'
      - '.th-updates.sbs'
      - '.rg-telemetry.sbs'
  condition: 1 of selection_*
level: high
---
# optional: lower fidelity, only a secondary report states that the extension is patched into Secure Preferences and Chrome helper process names vary; delete this line and every document below it
title: Chrome Secure Preferences Written by a Non-Chrome Process
id: c0cb412a-0787-4f1b-a518-3744c0349f84
status: experimental
description: >
  Detects a process other than Chrome writing Chrome's Secure Preferences
  file, the way the sideloaded Google Drive Offline extension is reported to
  be planted.
references:
  - https://aviatrix.ai/threat-research-center/dprk-linked-macos-malvertising-uses-fake-updates-to-deliver-crypto-stealing-malware/
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|endswith: '/Secure Preferences'
  filter_chrome:
    Image|contains: 'Google Chrome'
  condition: selection and not filter_chrome
falsepositives:
  - Browser management tools that edit Chrome profile preferences
level: medium

The process, identifier, DNS and hash signals over Falcon events on macOS; Falcon file-write events are not used, so persistence is left to the osquery query.

event_platform=Mac
| (#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ ((FileName=node ImageFileName=/\/Library\/Caches\//) or CommandLine=/(NODE_TLS_REJECT_UNAUTHORIZED=0|0x85a6d913aac80286f01fa082ef0b96c188673043|0x2aca749b59529f5cbcd6fbd34b35b1a546713df6|0x3bc5de30|0x277765fb63601ce5a9814daf68aa2a57f54ea968|0x89c5151236de544d077fc69813a4db89224ee8a1|0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192|0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2|xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf)/i))
or (#event_simpleName=DnsRequest DomainName=/(^|\.)(real-tumble\.pro|th-updates\.sbs|rg-telemetry\.sbs)$/i)
    // optional: lower fidelity, the three hashes are single builds and a rebuild changes them; delete this line and the next
    or (#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ in(SHA256HashData, values=["370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50"]))
| groupBy([aid, ComputerName], function=[count(as=Hits), count(#event_simpleName, distinct=true, as=SignalKinds), collect([#event_simpleName]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(SignalKinds, order=desc)

The same process, DNS, persistence, hash and RPC-host signals over Elastic Defend events from macOS hosts.

FROM logs-endpoint.events.*
| WHERE host.os.type == "macos"
| EVAL cmd = TO_LOWER(process.command_line), exe = TO_LOWER(process.executable), path = TO_LOWER(file.path), name = TO_LOWER(COALESCE(dns.question.name, destination.domain))
| WHERE (TO_LOWER(process.name) == "node" AND exe RLIKE ".*/library/caches/.*")
    OR cmd RLIKE ".*(node_tls_reject_unauthorized=0|0x85a6d913aac80286f01fa082ef0b96c188673043|0x2aca749b59529f5cbcd6fbd34b35b1a546713df6|0x3bc5de30|0x277765fb63601ce5a9814daf68aa2a57f54ea968|0x89c5151236de544d077fc69813a4db89224ee8a1|0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192|0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2|xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf).*"
    OR name RLIKE "(.*\\.)?(real-tumble\\.pro|th-updates\\.sbs|rg-telemetry\\.sbs)"
    OR (TO_LOWER(process.name) IN ("node", "sh", "bash", "zsh", "curl") AND (path RLIKE ".*/library/launchagents/.*" OR TO_LOWER(file.name) == ".zshrc"))
    OR (path RLIKE ".*/secure preferences" AND NOT TO_LOWER(process.name) RLIKE "google chrome.*")
    OR file.hash.sha256 IN ("370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50")
    OR process.hash.sha256 IN ("370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50")
    OR name == "eth-mainnet.rpcfast.com"
| EVAL signal = CASE(file.path IS NOT NULL, "file", process.command_line IS NOT NULL, "process", "network")
| STATS hits = COUNT(*), signal_kinds = COUNT_DISTINCT(signal), signals = VALUES(signal), last_seen = MAX(@timestamp) BY host.name
| SORT signal_kinds DESC, last_seen DESC

The same process, network, persistence and hash signals over Cortex events from macOS agents.

dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
| alter host = lowercase(coalesce(dns_query_name, action_external_hostname, ""))
| filter (event_type = ENUM.PROCESS and ((lowercase(action_process_image_name) = "node" and lowercase(action_process_image_path) ~= "/library/caches/") or lowercase(action_process_image_command_line) ~= "node_tls_reject_unauthorized=0|(0x85a6d913aac80286f01fa082ef0b96c188673043|0x2aca749b59529f5cbcd6fbd34b35b1a546713df6|0x3bc5de30|0x277765fb63601ce5a9814daf68aa2a57f54ea968|0x89c5151236de544d077fc69813a4db89224ee8a1|0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192|0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2|xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf)"))
    or (event_type = ENUM.NETWORK and host ~= "(^|[.])(real-tumble[.]pro|th-updates[.]sbs|rg-telemetry[.]sbs)$")
        // optional: lower fidelity, eth-mainnet.rpcfast.com is a legitimate RPC service and only the API key is the indicator; delete this line and the next
    or (event_type = ENUM.NETWORK and host = "eth-mainnet.rpcfast.com")
        // optional: lower fidelity, the report names no file for the launch agent or the .zshrc line, so legitimate installers and developer tools also match; delete this line and the next
    or (event_type = ENUM.FILE and lowercase(actor_process_image_name) in ("node", "sh", "bash", "zsh", "curl") and (lowercase(action_file_path) ~= "/library/launchagents/" or lowercase(action_file_name) = ".zshrc"))
        // optional: lower fidelity, only a secondary report states that the extension is patched into Secure Preferences and Chrome helper process names vary; delete this line and the next
    or (event_type = ENUM.FILE and lowercase(action_file_name) = "secure preferences" and lowercase(actor_process_image_name) !~= "google chrome")
        // optional: lower fidelity, the three hashes are single builds and a rebuild changes them; delete this line and the next
    or action_file_sha256 in ("370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50") or action_process_image_sha256 in ("370a5ae7f91291559ce514f44c50430dd2c35ed866bedcf6ac5f4f896259fbed", "529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795", "7eca7aef8dcc46f15349509ac3dff8c0a71295c233787872c3842e058f9d7c50")
| comp count() as hits, count_distinct(event_type) as signal_kinds, max(_time) as last_seen by agent_hostname
| sort desc signal_kinds, desc last_seen

A point-in-time check of the extension, running node, its environment and launch agents on the Mac in hand.

SELECT 'extension' AS signal, ce.name AS item, ce.identifier || ' ' || ce.path AS detail
FROM users u CROSS JOIN chrome_extensions ce USING (uid)
WHERE ce.name LIKE '%Drive Offline%'
   -- optional: lower fidelity, legitimate developer and automation extensions also request these permissions; delete this line and the three below it
   OR (ce.permissions LIKE '%debugger%'
       AND ce.permissions LIKE '%nativeMessaging%'
       AND ce.permissions LIKE '%cookies%')
UNION ALL
SELECT 'node from cache', name, path || ' ' || cmdline
FROM processes
WHERE name = 'node' AND (path LIKE '%/Library/Caches/%' OR cwd LIKE '%/Library/Caches/%' OR cmdline LIKE '%/Library/Caches/%')
UNION ALL
SELECT 'certificate checking disabled', p.name, p.cmdline
FROM processes p JOIN process_envs e USING (pid)
WHERE p.name = 'node' AND e.key = 'NODE_TLS_REJECT_UNAUTHORIZED' AND e.value = '0'
UNION ALL
SELECT 'launch agent', path, COALESCE(program, '') || ' ' || COALESCE(program_arguments, '')
FROM launchd
WHERE path LIKE '%/Library/LaunchAgents/%' AND (program LIKE '%/Library/Caches/%' OR program_arguments LIKE '%/Library/Caches/%');

Content rules for the malicious Manifest V3 extension and for configuration strings the report lists.

rule EtherHiding_Fake_Google_Drive_Offline_Manifest
{
    meta:
        description = "Chrome MV3 manifest named Google Drive Offline requesting debugger, native messaging, cookie and all-URL access"
        reference = "https://cybersecuritynews.com/north-korean-etherhiding-campaign/"
    strings:
        $name = "Google Drive Offline"
        $mv3 = /"manifest_version"\s*:\s*3/
        $p_debugger = "\"debugger\""
        $p_native = "\"nativeMessaging\""
        $p_cookies = "\"cookies\""
        $p_all = "<all_urls>"
        $msg = "__MSG_appName__"
    condition:
        filesize < 64KB and $mv3 and
        (
            ($name and 3 of ($p_*)) or
            ($msg and all of ($p_*))
        )
}

// optional: lower fidelity, the report does not say these strings appear as literals in the file; delete this line and the rule below it
rule EtherHiding_Fake_Google_Drive_Offline_Config_Strings
{
    meta:
        description = "Configuration strings reported for the Node.js backdoor and extension that read their configuration from an Ethereum contract"
        reference = "https://cybersecuritynews.com/north-korean-etherhiding-campaign/"
    strings:
        $contract1 = "0x85a6d913aac80286f01fa082ef0b96c188673043" nocase
        $contract2 = "0x2aca749b59529f5cbcd6fbd34b35b1a546713df6" nocase
        $xor1 = "9f10d0899beff7952f586a49305f8b14"
        $xor2 = "2752df77aeb348657f5fb59a22d65f4a"
        $c2_ext = "th-updates.sbs/analytics"
        $c2_bd = "rg-telemetry.sbs/api"
        $rpckey = "xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf"
    condition:
        filesize < 5MB and any of ($contract*, $xor*, $c2_*, $rpckey)
}