From a390d5a48ce3436abdcdd36cb447a56aa92a743d Mon Sep 17 00:00:00 2001
From: jovimon <jovimon@gmail.com>
Date: Wed, 25 Nov 2015 17:39:06 +0100
Subject: [PATCH] Unify Fake Android Apps Rules
All android fake application rules merged into fakeapps file. Other
files removed.
---
Mobile_Malware/Android_FakeApps.yar | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------------
Mobile_Malware/Android_malware_Fake_Facebook.yar | 33 ---------------------------------
Mobile_Malware/Android_malware_Fake_Minecraft.yar | 22 ----------------------
Mobile_Malware/Android_malware_Fake_market.yar | 21 ---------------------
4 files changed, 57 insertions(+), 89 deletions(-)
delete mode 100644 Mobile_Malware/Android_malware_Fake_Facebook.yar
delete mode 100644 Mobile_Malware/Android_malware_Fake_Minecraft.yar
delete mode 100644 Mobile_Malware/Android_malware_Fake_market.yar
diff --git a/Mobile_Malware/Android_FakeApps.yar b/Mobile_Malware/Android_FakeApps.yar
index e34422c..dc62c24 100644
--- a/Mobile_Malware/Android_FakeApps.yar
+++ b/Mobile_Malware/Android_FakeApps.yar
@@ -10,17 +10,49 @@
import "androguard"
-rule whatsapp:fake
+rule fake_facebook: fake
{
meta:
author = "https://twitter.com/Diviei"
reference = "https://koodous.com/"
condition:
- androguard.app_name("WhatsApp") and
- not androguard.certificate.sha1("38A0F7D505FE18FEC64FBF343ECAAAF310DBD799")
+ androguard.app_name("Facebook")
+ and not androguard.certificate.sha1("A0E980408030C669BCEB38FEFEC9527BE6C3DDD0")
+}
+
+
+rule fake_facebook_2 : fake
+{
+ meta:
+ author = "https://twitter.com/plutec_net"
+ reference = "https://koodous.com/"
+ description = "Detects fake facebook applications"
+ hash_0 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
+ hash_1 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
+ hash_2 = "70d5cc909d5718674474a54b44f83bd194cbdd2d99354d52cd868b334fb5f3de"
+ hash_3 = "38e757abd5e015e3c3690ea0fdc2ff1e04b716651645a8c4ca6a63185856fe29"
+ hash_4 = "ba0b8fe37b4874656ad129dd4d96fdec181e2c3488985309241b0449bb4ab84f"
+ hash_5 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
+ hash_6 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
+ hash_7 = "7345c3124891b34607a07e93c8ab6dcbbf513e24e936c3710434b085981b815a"
+
+ condition:
+ androguard.app_name("Facebook") and
+ not androguard.package_name(/com.facebook.katana/) and
+ not androguard.certificate.issuer(/O=Facebook Mobile/)
+}
+
+rule fake_instagram: fake
+{
+ meta:
+ author = "https://twitter.com/Diviei"
+ reference = "https://koodous.com/"
+ condition:
+ androguard.app_name("Instagram")
+ and not androguard.certificate.sha1("76D72C35164513A4A7EBA098ACCB2B22D2229CBE")
}
-rule king_games:fake
+rule fake_king_games: fake
{
condition:
(androguard.app_name("AlphaBetty Saga")
@@ -38,22 +70,34 @@ rule king_games:fake
and not androguard.certificate.sha1("9E93B3336C767C3ABA6FCC4DEADA9F179EE4A05B")
}
-rule facebook:fake
+rule fake_market: fake
{
meta:
- author = "https://twitter.com/Diviei"
- reference = "https://koodous.com/"
+ author = "https://twitter.com/plutec_net"
+ reference = "https://koodous.com/"
+
condition:
- androguard.app_name("Facebook")
- and not androguard.certificate.sha1("A0E980408030C669BCEB38FEFEC9527BE6C3DDD0")
+ androguard.package_name("com.minitorrent.kimill")
}
-rule instagram:fake
+
+rule fake_minecraft: fake
+{
+ meta:
+ author = "https://twitter.com/plutec_net"
+ reference = "https://koodous.com/"
+ condition:
+ ( androguard.app_name("Minecraft: Pocket Edition") or
+ androguard.app_name("Minecraft - Pocket Edition") )
+ and not androguard.package_name("com.mojang.minecraftpe")
+}
+
+rule fake_whatsapp: fake
{
meta:
author = "https://twitter.com/Diviei"
reference = "https://koodous.com/"
condition:
- androguard.app_name("Instagram")
- and not androguard.certificate.sha1("76D72C35164513A4A7EBA098ACCB2B22D2229CBE")
-}
+ androguard.app_name("WhatsApp") and
+ not androguard.certificate.sha1("38A0F7D505FE18FEC64FBF343ECAAAF310DBD799")
+}
\ No newline at end of file
diff --git a/Mobile_Malware/Android_malware_Fake_Facebook.yar b/Mobile_Malware/Android_malware_Fake_Facebook.yar
deleted file mode 100644
index 6bb7167..0000000
--- a/Mobile_Malware/Android_malware_Fake_Facebook.yar
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
-*/
-
-/*
- Androguard module used in this rule file is under development by people at https://koodous.com/.
-
- You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
-*/
-
-import "androguard"
-
-rule facebook : fakebook
-{
- meta:
- author = "https://twitter.com/plutec_net"
- reference = "https://koodous.com/"
- description = "Detects fake facebook applications"
- hash_0 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
- hash_1 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
- hash_2 = "70d5cc909d5718674474a54b44f83bd194cbdd2d99354d52cd868b334fb5f3de"
- hash_3 = "38e757abd5e015e3c3690ea0fdc2ff1e04b716651645a8c4ca6a63185856fe29"
- hash_4 = "ba0b8fe37b4874656ad129dd4d96fdec181e2c3488985309241b0449bb4ab84f"
- hash_5 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
- hash_6 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
- hash_7 = "7345c3124891b34607a07e93c8ab6dcbbf513e24e936c3710434b085981b815a"
-
- condition:
- androguard.app_name("Facebook") and
- not androguard.package_name(/com.facebook.katana/) and
- not androguard.certificate.issuer(/O=Facebook Mobile/)
-
-}
diff --git a/Mobile_Malware/Android_malware_Fake_Minecraft.yar b/Mobile_Malware/Android_malware_Fake_Minecraft.yar
deleted file mode 100644
index f897cad..0000000
--- a/Mobile_Malware/Android_malware_Fake_Minecraft.yar
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
-*/
-
-/*
- Androguard module used in this rule file is under development by people at https://koodous.com/.
-
- You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
-*/
-
-import "androguard"
-
-rule minecraft
-{
- meta:
- author = "https://twitter.com/plutec_net"
- reference = "https://koodous.com/"
- condition:
- ( androguard.app_name("Minecraft: Pocket Edition") or
- androguard.app_name("Minecraft - Pocket Edition") )
- and not androguard.package_name("com.mojang.minecraftpe")
-}
diff --git a/Mobile_Malware/Android_malware_Fake_market.yar b/Mobile_Malware/Android_malware_Fake_market.yar
deleted file mode 100644
index b59858c..0000000
--- a/Mobile_Malware/Android_malware_Fake_market.yar
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
-*/
-
-/*
- Androguard module used in this rule file is under development by people at https://koodous.com/.
-
- You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara
-*/
-
-import "androguard"
-
-rule fake_market
-{
- meta:
- author = "https://twitter.com/plutec_net"
- reference = "https://koodous.com/"
-
- condition:
- androguard.package_name("com.minitorrent.kimill")
-}
--
libgit2 0.26.0