Create Android_SandroRat.yar

6fb3105b · mmorenog · GitHub · 654e10b1 · 6fb3105b
Commit 6fb3105b authored Jul 06, 2016 by mmorenog Committed by GitHub Jul 06, 2016
Show whitespace changes
Inline Side-by-side

Showing with 14 additions and 0 deletions

Android_SandroRat.yar Mobile_Malware/Android_SandroRat.yar +14 -0

No files found.
--- a/Mobile_Malware/Android_SandroRat.yar
+++ b/Mobile_Malware/Android_SandroRat.yar
+import "androguard"
+
+
+rule SandroRat
+{
+	meta:
+		author = "Jacob Soo Lead Re"
+		date = "21-May-2016"
+		description = "This rule detects SandroRat"
+		source = "https://blogs.mcafee.com/mcafee-labs/sandrorat-android-rat-targeting-polish-banking-users-via-e-mail-phishing/"
+
+	condition:
+		androguard.activity(/net.droidjack.server/i) 
+}