Create Android_SpyAgent.yar

Mobile_Malware/Android_SpyAgent.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+import "androguard"
+import "file"
+
+
+rule spyAgent
+{
+	meta:
+		description = "This rule detects arabian spyware which records call and gathers user information which is later sent to a remote c&c"
+		sample = "7cbf61fbb31c26530cafb46282f5c90bc10fe5c724442b8d1a0b87a8125204cb"
+		reference = "https://blogs.mcafee.com/mcafee-labs/android-spyware-targets-security-job-seekers-in-saudi-arabia/"
+		author = "@koodous_project"
+
+	strings:
+		$phone = "0597794205"
+		$caption = "New victim arrived"
+		$cc = "http://ksa-sef.com/Hack%20Mobaile/ADDNewSMS.php"
+		$cc_alt = "http://ksa-sef.com/Hack%20Mobaile/AddAllLogCall.php"
+		$cc_alt2= "http://ksa-sef.com/Hack%20Mobaile/addScreenShot.php"
+		$cc_alt3= "http://ksa-sef.com/Hack%20Mobaile/ADDSMS.php"
+		$cc_alt4 = "http://ksa-sef.com/Hack%20Mobaile/ADDVCF.php"
+		$cc_alt5 = "http://ksa-sef.com/Hack%20Mobaile/ADDIMSI.php"
+		$cc_alt6 = "http://ksa-sef.com/Hack%20Mobaile/ADDHISTORYINTERNET.php"
+		$cc_alt7 = "http://ksa-sef.com/Hack%20Mobaile/addInconingLogs.php"
+
+	condition:
+		androguard.url(/ksa-sef\.com/) or ($phone and $caption) or ($cc and $cc_alt and $cc_alt2 and $cc_alt3 and $cc_alt4 and $cc_alt5 and $cc_alt6 and $cc_alt7)
+		
+}