Moonlight/Moonlight/App/MalwareScans/SelfBotScan.cs

using Moonlight.App.Database.Entities;
using Moonlight.App.Models.Misc;
using Moonlight.App.Services;

namespace Moonlight.App.MalwareScans;

public class SelfBotScan : MalwareScan
{
    public override string Name => "Selfbot Scan";
    public override string Description => "This scan is a simple selfbot scan provided by moonlight";

    public override async Task<MalwareScanResult[]> Scan(Server server, IServiceProvider serviceProvider)
    {
        var serverService = serviceProvider.GetRequiredService<ServerService>();
        var access = await serverService.CreateFileAccess(server, null!);
        var fileElements = await access.Ls();

        if (fileElements.Any(x => x.Name == "tokens.txt"))
        {
            return new[]
            {
                new MalwareScanResult
                {
                    Title = "Found SelfBot",
                    Description = "Detected suspicious 'tokens.txt' file which may contain tokens for a selfbot",
                    Author = "Marcel Baumgartner"
                }
            };
        }

        return Array.Empty<MalwareScanResult>();
    }
}