#!/usr/bin/env sh

echo "Mexals Detection Script by Akamai Threat Labs"

persist=false
binary=false
process=false
backdoor=false

crontab -l 2>/dev/null | grep -q "/var/tmp/.update-logs\|/var/tmp/Documents\|/var/tmp/.ladyg0g0\|/dev/shm/.x\|/dev/shm/.magic" && {
    persist=true
    echo "[*] Mexals persistence cron detected"
}

find /var/tmp/ -type f 2>/dev/null | grep -q ".update-logs\|/Documents\|.ladyg0g0" && {
    binary=true
    echo "[*] Mexals binary path detected"
}

find /dev/shm/ -type f 2>/dev/null | grep -q ".x\|.magic" && {
    binary=true
    echo "[*] Mexals binary path detected"
}

ps 2>/dev/null | grep -q "Chrome\|Update\|aliases\|Opera\|.diicot\|retea\|network\|History\|payload" > /dev/null && {
    process=true
    echo '[*] Mexals process name detected'
}

cat ~/.ssh/authorized_keys 2>/dev/null | grep -q "AAAAB3NzaC1yc2EAAAABJQAAAQEAoBjnno5GBoIuIYIhrJsQxF6OPHtAbOUIEFB+gdfb1tUTjs+f9zCMGkmNmH45fYVukw6IwmhTZ+AcD3eDpgsTloqmVgcXDUmvjWR/fNiImmgU9wlw/lalf/WrIuCDp0PArQtjNg/vo7HUGq9SrEIE2jvyVW59mvoYOwfnDLUiguKZirZgpjZF2DDKK6WpZVTVpKcH+HEFdmFAqJInem/CRUE0bqjMr88bUyDjVw9FtJ5EmQenctjrFVaB7hswOaJBmFQmn9G/BXkMvZ6mX7LzCUM2PVHnVfVeCLdwiOINikzW9qzlr8WoHw4qEGJLuQBWXjJu+m2+FdaOD6PL53nY3w==\|ElPatrono1337" && {
    backdoor=true
    echo '[*] Mexals SSH key detected'
}

if $persist || $process || $binary || $backdoor; then
    echo "[*] There is evidence of Mexals malicious activity on this machine."
    exit 1
else
    echo '[*] No Mexals artifacts found'
    exit 0
fi