Create Android_Metasploit.yar

Mobile_Malware/Android_Metasploit.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+*/
+
+
+rule android_meterpreter
+{
+    meta:
+        author="73mp74710n"
+        ref = "https://github.com/zombieleet/yara-rules/blob/master/android_metasploit.yar"
+        comment="Metasploit Android Meterpreter Payload"
+        
+    strings:
+	$checkPK = "META-INF/PK"
+	$checkHp = "[Hp^"
+	$checkSdeEncode = /;.Sk/
+	$stopEval = "eval"
+	$stopBase64 = "base64_decode"
+	
+    condition:
+	any of ($check*) or any of ($stop*)
+}