1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
rule sakura_jar : EK
{
meta:
author = "Josh Berry"
date = "2016-06-26"
description = "Sakura Exploit Kit Detection"
hash0 = "a566ba2e3f260c90e01366e8b0d724eb"
sample_filetype = "unknown"
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
$string0 = "Rotok.classPK"
$string1 = "nnnolg"
$string2 = "X$Z'\\4^=aEbIdUmiprsxt}v<" wide
$string3 = "()Ljava/util/Set;"
$string4 = "(Ljava/lang/String;)V"
$string5 = "Ljava/lang/Exception;"
$string6 = "oooy32"
$string7 = "Too.java"
$string8 = "bbfwkd"
$string9 = "Ljava/lang/Process;"
$string10 = "getParameter"
$string11 = "length"
$string12 = "Simio.java"
$string13 = "Ljavax/swing/JList;"
$string14 = "-(Ljava/lang/String;)Ljava/lang/StringBuilder;"
$string15 = "Ljava/io/InputStream;"
$string16 = "vfnnnrof.exnnnroe"
$string17 = "Olsnnfw"
condition:
17 of them
}
rule sakura_jar2 : EK jar
{
meta:
author = "Josh Berry"
date = "2016-06-26"
description = "Sakura Exploit Kit Detection"
hash0 = "d21b4e2056e5ef9f9432302f445bcbe1"
sample_filetype = "unknown"
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
$string0 = "getProperty"
$string1 = "java/io/FileNotFoundException"
$string2 = "LLolp;"
$string3 = "cjhgreshhnuf "
$string4 = "StackMapTable"
$string5 = "onfwwa"
$string6 = "(C)Ljava/lang/StringBuilder;"
$string7 = "replace"
$string8 = "LEsia$fffgss;"
$string9 = "<clinit>"
$string10 = "()Ljava/io/InputStream;"
$string11 = "openConnection"
$string12 = " gjhgreshhnijhgreshhrtSjhgreshhot.sjhgreshhihjhgreshht;)"
$string13 = "Oi.class"
$string14 = " rjhgreshhorjhgreshhre rajhgreshhv"
$string15 = "java/lang/String"
$string16 = "java/net/URL"
$string17 = "Created-By: 1.7.0-b147 (Oracle Corporation)"
condition:
17 of them
}