One Hat Cyber Team

Edit File: ai-bolit-hoster.php.patch

--- ai-bolit-hoster.php.dist	2026-02-09 10:45:00.000000000 +0100
+++ ai-bolit-hoster.php.cpaneldev	2026-03-12 13:36:08.590609263 +0100
@@ -112,6 +112,7 @@
 define('DEFAULT_HS_PATH', '/var/imunify360/files/sigs/v1/aibolit/hyperscan');
 define('DEFAULT_EXT_SUS_PATH', DEFAULT_HS_PATH . '/hs_susext.db');
 define('DEFAULT_IGN_SUS_PATH', '/etc/imunify360/malware-ignore-hashes.txt');
+define('DEFAULT_CST_SUS_PATH', '/etc/imunify360/malware-custom-hashes.txt');
 
 define('I360_CONFIG', '/etc/sysconfig/imunify360/imunify360-merged.config');
 
@@ -786,6 +787,14 @@
         define('PATH_IGN_SUS', DEFAULT_IGN_SUS_PATH);
     }
 
+    if (!defined('PATH_CST_SUS') && getenv('AIBOLIT_TEST_CONFIG') && getenv('PATH_CST_SUS')) {
+        define('PATH_CST_SUS', getenv('PATH_CST_SUS'));
+    }
+
+    if (!defined('PATH_CST_SUS') && defined('DEFAULT_CST_SUS_PATH')) {
+        define('PATH_CST_SUS', DEFAULT_CST_SUS_PATH);
+    }
+
     if (!defined('SMART_SCAN')) {
         define('SMART_SCAN', 0);
     }
@@ -2139,6 +2148,8 @@
     public $_DeMapper;
     public $_Mnemo;
 
+    public $_CustomSha256Sig;
+
     public $whiteUrls;
 
     /**
@@ -2203,6 +2214,8 @@
         $this->sig_db_meta_info['version'] = $avdb_meta_info ? $avdb_meta_info['version'] : 'n/a';
         $this->sig_db_meta_info['release-type'] = $avdb_meta_info ? $avdb_meta_info['release-type'] : 'n/a';
 
+        $this->_CustomSha256Sig = $this->load_custom_list_sha256();
+
         if (count($this->_DBShe) <= 1) {
             $this->_DBShe = [];
         }
@@ -2305,6 +2318,40 @@
         }
     }
 
+    /*
+     * Load
+     * /etc/imunify360/malware-custom-hashes.txt
+     *
+     * @param array $list
+     * @return array
+     */
+    private function load_custom_list_sha256()
+    {
+        $file = defined('PATH_CST_SUS') ? PATH_CST_SUS : '';
+        if (!is_readable($file)) {
+            return [];
+        }
+
+        $custom_hashes = [];
+
+        $file_obj = new SplFileObject($file, 'r');
+        $file_obj->setFlags(SplFileObject::DROP_NEW_LINE | SplFileObject::SKIP_EMPTY | SplFileObject::READ_AHEAD);
+        foreach ($file_obj as $hash) {
+            $hash = trim($hash);
+            if (!empty($hash) && $hash[0] !== '#') {
+                $custom_hashes[$hash] = $hash;
+            }
+        }
+
+        if (empty($custom_hashes)) {
+            return [];
+        }
+
+        stdOut("\nLoaded " . count($custom_hashes) . " known hash of files from " . $file . "\n");
+
+        return $custom_hashes;
+    }
+
     private function OptimizeSignatures($debug)
     {
         ($this->mode == 2) && ($this->_FlexDBShe = array_merge($this->_FlexDBShe, $this->X_FlexDBShe, $this->XX_FlexDBShe));
@@ -8977,6 +9024,26 @@
 
         $started = AibolitHelpers::currentTime();
 
+// IDE KELLENE TENNI AZ SHA256 alapu checket
+
+        if (array_key_exists( $file->getSha256(), $vars->signs->_CustomSha256Sig ) === true ) {
+            $this->AddResult($file, $i, $vars);
+
+            $heur_sig = 'SMW-CUSTOM-SHA256';
+
+            $this->addStatsItem('elf', 'heuristics', $file);
+            $vars->criticalPHP[]         = $i;
+            $vars->criticalPHPFragment[] = $heur_sig;
+            $vars->criticalPHPSig[]      = $heur_sig;
+            HashVerdicts::add($file->getSha256(), 'elf:heuristics');
+
+            $return = [ RapidScanStorageRecord::HEURISTIC, $heur_sig, $heur_sig ];
+
+            return $return;
+        }
+
+// Idaig a SHA256 alapu check
+
         if (AI_DEOBFUSCATE) {
             $l_DeobfObj = new Deobfuscator($l_Unwrapped, $l_Content, $this->debug->isDebug() ? $this->debug : null);
             $l_DeobfType = $l_DeobfObj->getObfuscateType($l_Unwrapped);