Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
rules
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
rules
Commits
fd426fd8
Commit
fd426fd8
authored
Nov 18, 2016
by
mmorenog
Committed by
GitHub
Nov 18, 2016
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update Android_HackintTeam_Implant.yar
parent
58ef4b33
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
3 additions
and
3 deletions
+3
-3
Android_HackintTeam_Implant.yar
Mobile_Malware/Android_HackintTeam_Implant.yar
+3
-3
No files found.
Mobile_Malware/Android_HackintTeam_Implant.yar
View file @
fd426fd8
...
...
@@ -7,10 +7,10 @@ rule HackingTeam_Android : Android Implant
meta:
description = "HackingTeam Android implant, known to detect version v4 - v7"
author = "Tim 'diff' Strazzere <strazz@gmail.com>"
reference = "http://rednaga.io/2016/11/14/hackingteam_back_for_your_androids/"
reference = "http://rednaga.io/2016/11/14/hackingteam_back_for_your_androids/"
date = "2016-11-14"
version = "1.0"
strings:
strings:
$decryptor = {
12 01 // const/4 v1, 0x0
D8 00 ?? ?? // add-int/lit8 ??, ??, ??
...
...
@@ -48,6 +48,6 @@ rule HackingTeam_Android : Android Implant
00 12 67 65 74 53 6D 73 49 6E 70 75 74 4E 75 6D
62 65 72 73 00
}
condition:
condition:
$decryptor and ($settings and $getSmsInputNumbers)
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment