Create Android_Tempting_Cedar_Spyware.yar

see reference for hashes

Create Android_Tempting_Cedar_Spyware.yar
see reference for hashes
6da7317e · Mike Worth · GitHub · 1d8bdc85 · 6da7317e
Unverified Commit 6da7317e authored 7 years ago by Mike Worth Committed by GitHub 7 years ago
Show whitespace changes
Inline Side-by-side

Showing with 15 additions and 0 deletions

Android_Tempting_Cedar_Spyware.yar Mobile_Malware/Android_Tempting_Cedar_Spyware.yar +15 -0

No files found.
--- a/Mobile_Malware/Android_Tempting_Cedar_Spyware.yar
+++ b/Mobile_Malware/Android_Tempting_Cedar_Spyware.yar
+rule android_tempting_cedar_spyware
+{
+	meta:
+    	Author = "@X0RC1SM"
+        Date = "2018-03-06"
+        Reference = "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware"
+	strings:
+		$PK_HEADER = {50 4B 03 04}
+		$MANIFEST = "META-INF/MANIFEST.MF"
+		$DEX_FILE = "classes.dex"
+		$string = "rsdroid.crt"
+	condition:
+    	$PK_HEADER in (0..4) and $MANIFEST and $DEX_FILE and any of ($string*)
+}