add anydesk, hackingteam

leaked/anydesk_leaked_certificate.yml

@@ -0,0 +1,12 @@
+name: anydesk_leaked_certificate
+meta:
+  status: revoked
+  source: leaked
+  description: |
+    AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement 
+  references: "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar"
+  date: 07-02-2024
+  author: Florian Roth 
+issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
+serial: ["0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8"]
+timestamp: 1706486400 

leaked/hangil_it_leaked_certificate.yml

@@ -0,0 +1,11 @@
+name: hangil_it_leaked_certificate
+meta:
+  status: revoked
+  source: leaked
+  description: |
+    Leaked Hangil IT Co., Ltd certificate utilised by various malware.
+  references: ""
+  date: 15-11-2023
+  author: Riccardo Ancarani 
+issuer: Sectigo Public Code Signing CA R36
+serial: ["01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45"]

malicious/hacking_team_malicious_certificate.yml

@@ -0,0 +1,11 @@
+name: hacking_team_malicious_certificate
+meta:
+  status: expired
+  source: malicious
+  description: |
+    Certificate utilised by Hacking Team.
+  references: https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days
+  date: 15-11-2023
+  author: WithSecure 
+issuer: VeriSign Class 3 Code Signing 2010 CA
+serial: ["0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d"]