I was looking at some ABCbot samples and noticed that some of them included the golang ssh package. I thought this would be useful to know when looking at new samples.

rule golang_ssh
{
	meta:
		description = "Golang binary including golang.org/x/crypto/ssh"
		reference = "https://pkg.go.dev/golang.org/x/crypto/ssh"

	strings:
		$ = "golang.org/x/crypto/ssh"

	condition:
		all of them
}

YARA Rules Index