Create Android_malware_Fake_Facebook.yar

Malware_Mobile/Android_malware_Fake_Facebook.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+import "androguard"
+
+rule facebook : fakebook
+{
+	meta:
+		author = "https://twitter.com/plutec_net"
+		reference = "https://koodous.com/"
+		description = "Detects fake facebook applications"
+		hash_0 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
+		hash_1 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
+		hash_2 = "70d5cc909d5718674474a54b44f83bd194cbdd2d99354d52cd868b334fb5f3de"
+		hash_3 = "38e757abd5e015e3c3690ea0fdc2ff1e04b716651645a8c4ca6a63185856fe29"
+		hash_4 = "ba0b8fe37b4874656ad129dd4d96fdec181e2c3488985309241b0449bb4ab84f"
+		hash_5 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
+		hash_6 = "c1264c689393880361409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
+		hash_7 = "7345c3124891b34607a07e93c8ab6dcbbf513e24e936c3710434b085981b815a"
+		
+	condition:
+		androguard.app_name("Facebook") and
+		not androguard.package_name(/com.facebook.katana/) and 
+		not androguard.certificate.issuer(/O=Facebook Mobile/)
+		
+}