Create MALW_PyPI

78432386 · Bart · GitHub · 20c8914a · 78432386
Commit 78432386 authored Sep 16, 2017 by Bart Committed by GitHub Sep 16, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 17 additions and 0 deletions

MALW_PyPI malware/MALW_PyPI +17 -0

No files found.
--- a/malware/MALW_PyPI
+++ b/malware/MALW_PyPI
+rule MALW_FakePyPI
+{
+meta:
+	description = "Identifies fake PyPI Packages."
+	author = "@bartblaze"
+	reference = "http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/"
+	date = "2017-09"
+	tlp = "white"
+
+strings:	
+	$ = "# Welcome Here! :)"
+	$ = "# just toy, no harm :)"
+	$ = "[0x76,0x21,0xfe,0xcc,0xee]"
+
+condition:
+	all of them
+}