/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
import "androguard"
rule spyAgent
{
meta:
description = "This rule detects arabian spyware which records call and gathers user information which is later sent to a remote c&c"
sample = "7cbf61fbb31c26530cafb46282f5c90bc10fe5c724442b8d1a0b87a8125204cb"
reference = "https://blogs.mcafee.com/mcafee-labs/android-spyware-targets-security-job-seekers-in-saudi-arabia/"
author = "@koodous_project"
strings:
$phone = "0597794205"
$caption = "New victim arrived"
$cc = "http://ksa-sef.com/Hack%20Mobaile/ADDNewSMS.php"
$cc_alt = "http://ksa-sef.com/Hack%20Mobaile/AddAllLogCall.php"
$cc_alt2= "http://ksa-sef.com/Hack%20Mobaile/addScreenShot.php"
$cc_alt3= "http://ksa-sef.com/Hack%20Mobaile/ADDSMS.php"
$cc_alt4 = "http://ksa-sef.com/Hack%20Mobaile/ADDVCF.php"
$cc_alt5 = "http://ksa-sef.com/Hack%20Mobaile/ADDIMSI.php"
$cc_alt6 = "http://ksa-sef.com/Hack%20Mobaile/ADDHISTORYINTERNET.php"
$cc_alt7 = "http://ksa-sef.com/Hack%20Mobaile/addInconingLogs.php"
condition:
androguard.url(/ksa-sef\.com/) or ($phone and $caption) or ($cc and $cc_alt and $cc_alt2 and $cc_alt3 and $cc_alt4 and $cc_alt5 and $cc_alt6 and $cc_alt7)
}