Merge pull request #54 from Koodous/master

Added 2 rules to detect adware and smsfraud APKs

Mobile_Malware/Android_generic_adware.yar

+rule dowgin:adware
+{
+    meta:
+        author = "https://twitter.com/plutec_net"
+        reference = "https://koodous.com/"
+        sample = "4d7f2d6ff4ed8ced6f8f7f96e9899273cc3090ea108f2cc3b32dd1a06e63cf70"
+        sample2 = "cde8160d09c486bdd6d96b2ed81bd52390d77094d13ff9cfbc6949ed00206a83"
+        sample3 = "d2e81e6db5f4964246d10241588e0e97cde524815c4de7c0ea1c34a48da1bcaf"
+        sample4 = "cc2d0b3d8f00690298b0e5813f6ace8f4d4b04c9704292407c2b83a12c69617b"
+
+    strings:
+        $a = "http://112.74.111.42:8000"
+        $b = "SHA1-Digest: oIx4iYWeTtKib4fBH7hcONeHuaE="
+        $c = "ONLINEGAMEPROCEDURE_WHICH_WAP_ID"
+        $d = "http://da.mmarket.com/mmsdk/mmsdk?func=mmsdk:posteventlog"
+
+    condition:
+        all of them
+        
+}
\ No newline at end of file

Mobile_Malware/Android_generic_smsfraud.yar

+rule genericSMS : smsFraud
+{
+	meta:
+	    	author = "https://twitter.com/plutec_net"
+            	reference = "https://koodous.com/"
+	    	sample = "3fc533d832e22dc3bc161e5190edf242f70fbc4764267ca073de5a8e3ae23272"
+	    	sample2 = "3d85bdd0faea9c985749c614a0676bb05f017f6bde3651f2b819c7ac40a02d5f"
+
+	strings:
+		$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
+		$b = "SHA1-Digest: Rt2oRts0wWTjffGlETGfFix1dfE="
+		$c = "http://image.baidu.com/wisebrowse/index?tag1=%E6%98%8E%E6%98%9F&tag2=%E5%A5%B3%E6%98%8E%E6%98%9F&tag3=%E5%85%A8%E9%83%A8&pn=0&rn=10&fmpage=index&pos=magic#/channel"
+		$d = "pitchfork=022D4"
+
+	condition:
+		all of them
+		
+}
+
+rule genericSMS2 : smsFraud
+{
+	meta:
+		author = "https://twitter.com/plutec_net"
+                reference = "https://koodous.com/"
+		sample = "1f23524e32c12c56be0c9a25c69ab7dc21501169c57f8d6a95c051397263cf9f"
+		sample2 = "2cf073bd8de8aad6cc0d6ad5c98e1ba458bd0910b043a69a25aabdc2728ea2bd"
+		sample3 = "20575a3e5e97bcfbf2c3c1d905d967e91a00d69758eb15588bdafacb4c854cba"
+
+	strings:
+		$a = "NotLeftTriangleEqual=022EC"
+		$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
+		$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
+		$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"
+
+	condition:
+		all of them
+		
+}