This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule Dendroid
...
...
@@ -8,7 +7,7 @@ rule Dendroid
meta:
author = "https://twitter.com/jsmesa"
reference = "https://koodous.com/"
description = "Dendroid RAT"
description = "Dendroid RAT"
strings:
$s1 = "/upload-pictures.php?"
$s2 = "Opened Dialog:"
...
...
@@ -25,7 +24,7 @@ rule Dendroid_2
meta:
author = "https://twitter.com/jsmesa"
reference = "https://koodous.com/"
description = "Dendroid evidences via Droidian service"
description = "Dendroid evidences via Droidian service"
strings:
$a = "Droidian"
$b = "DroidianService"
...
...
@@ -39,7 +38,7 @@ rule Dendroid_3
meta:
author = "https://twitter.com/jsmesa"
reference = "https://koodous.com/"
description = "Dendroid evidences via ServiceReceiver"
description = "Dendroid evidences via ServiceReceiver"
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
*/
import "androguard"
rule hacking_team : stcert
{
meta:
...
...
@@ -44,6 +51,4 @@ rule hacking_team : stcert
//97257C6D8F6DA60EA27D2388D9AE252657FF3304 this certification could be stolen
//03EA873D5D13707B0C278A0055E452416054E27B this certification could be stolen
//B8D5E3F0BCAD2EB03BB34AEE2B3F63FC5162C56B this certification could be stolen
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
/*
Androguard module used in this rule file is under development by people at https://koodous.com/. Unfortunately it isn't published yet.
We will update this rule file and our website once the module is published.
Androguard module is based on androguard tool available @ https://github.com/androguard/androguard.
https://koodous.com/ is a very nice android malware analysis platform you can check out if you want to analyze your APK.
*/
import "androguard"
rule Android_Malware : iBanking
{
meta:
...
...
@@ -22,8 +33,6 @@ rule Android_Malware : iBanking
($pk at 0 and 2 of ($file*) and ($string1 or $string2))
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
