Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
rules
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
rules
Commits
a63977cc
Commit
a63977cc
authored
Sep 18, 2015
by
Antonio S
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Fixed bad example sample and add one more rule
parent
1f8c2e21
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
25 additions
and
5 deletions
+25
-5
Android_generic_smsfraud.yar
Mobile_Malware/Android_generic_smsfraud.yar
+25
-5
No files found.
Mobile_Malware/Android_generic_smsfraud.yar
View file @
a63977cc
rule genericSMS : smsFraud
{
meta:
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "e6ef34577a75fc0dc0a1f473304de1fc3a0d7d330bf58448db5f3108ed92741b"
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "3fc533d832e22dc3bc161e5190edf242f70fbc4764267ca073de5a8e3ae23272"
sample2 = "3d85bdd0faea9c985749c614a0676bb05f017f6bde3651f2b819c7ac40a02d5f"
strings:
$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
...
...
@@ -14,4 +15,24 @@ rule genericSMS : smsFraud
condition:
all of them
}
\ No newline at end of file
}
rule genericSMS2 : smsFraud
{
meta:
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "1f23524e32c12c56be0c9a25c69ab7dc21501169c57f8d6a95c051397263cf9f"
sample2 = "2cf073bd8de8aad6cc0d6ad5c98e1ba458bd0910b043a69a25aabdc2728ea2bd"
sample3 = "20575a3e5e97bcfbf2c3c1d905d967e91a00d69758eb15588bdafacb4c854cba"
strings:
$a = "NotLeftTriangleEqual=022EC"
$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"
condition:
all of them
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment