Create Android_SlemBunk.yar

Mobile_Malware/Android_SlemBunk.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+
+rule SlemBunk
+{
+	meta:
+		description = "Rule to detect trojans imitating banks of North America, Eurpope and Asia"
+		author = "@plutec_net"
+		sample = "e6ef34577a75fc0dc0a1f473304de1fc3a0d7d330bf58448db5f3108ed92741b"
+		source = "https://www.fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html"
+
+	strings:
+		$a = "#intercept_sms_start"
+		$b = "#intercept_sms_stop"
+		$c = "#block_numbers"
+		$d = "#wipe_data"
+		$e = "Visa Electron"
+
+	condition:
+		all of them
+		
+}