#!/usr/bin/env sh

echo "NoaBot Detection Script by Akamai Threat Labs"

persist=false
binary=false
process=false
backdoor=false

crontab -l 2>/dev/null | grep -q -G "\/lib\/.+\/(?:magicPussy|mimic_|ScBr_).+" && {
    persist=true
    echo "[*] NoaBot persistence cron detected"
}

find /lib/ -type f 2>/dev/null | grep -q -G "(?:magicPussy|mimic_|ScBr_).+" && {
    binary=true
    echo "[*] NoaBot binary path detected"
}

ps 2>/dev/null | grep -q -G "(?:magicPussy|mimic_|ScBr_).+" > /dev/null && {
    process=true
    echo '[*] NoaBot process name detected'
}

cat ~/.ssh/authorized_keys 2>/dev/null | grep -q "AAAAB3NzaC1yc2EAAAADAQABAAABgQDtlkWJzOwt6Erl3lDRq+QUSop854X/tC9BcU0bBk+5qLvPAU/FIsQmIPGjW5xNauKGiX/wSYvxuZpmnM6s400YEOlmqIxr13QChFK1aovjNUypK5upgjUHyPp98rP3CBtj7Zjwr3RICOzCFYdrTKEjy8QW/1dO8OjCr34UKq5zfoCkh3T7OtVmDzKkbvGilHYpLeJcSoaFqBQYzyfeRb4FFSY660WLBc33UVdjzjV2LqM7RfR5W6M5+QPuPrKze7x0hQwnRaNEIGBJVBVx3gribIo1t18zEcbpUiWp1yQzCl8ShyhtkyIb8wkEfwrULDaQWNAOHHq+fEC/4sI31A7+MT45m/U3NpQflvmzZhbbNsIQdPhnw7tlDK71n/ifcWZPwmgCFWi58DnFWfEX6SZp36RulActSclpqcUx1WxvnHZ25zMei5Q+cSoNWY2XWiRm0Pcub4VKDGT4Ram8zYJCABU23TaITgew4kt6Q4zEMCKe5kOJA3xYgNgPGhyX9fk=\|rainbow@mommy" && {
    backdoor=true
    echo '[*] NoaBot SSH key detected'
}

if $persist || $process || $binary || $backdoor; then
    echo "[*] There is evidence of NoaBot malicious activity on this machine."
    exit 1
else
    echo '[*] No NoaBot artifacts found'
    exit 0
fi