From 041ade0710885ca3b57e45bf4c4febba784ffd27 Mon Sep 17 00:00:00 2001 From: mmorenog Date: Wed, 6 Jul 2016 08:43:19 +0200 Subject: [PATCH] Create Android_DeathRing.yar --- Mobile_Malware/Android_DeathRing.yar | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 Mobile_Malware/Android_DeathRing.yar diff --git a/Mobile_Malware/Android_DeathRing.yar b/Mobile_Malware/Android_DeathRing.yar new file mode 100644 index 0000000..7b0799a --- /dev/null +++ b/Mobile_Malware/Android_DeathRing.yar @@ -0,0 +1,14 @@ +import "androguard" + +rule Android_DeathRing +{ + meta: + author = "Jacob Soo Lead Re" + date = "06-June-2016" + description = "DeathRing is a Chinese Trojan that is pre-installed on a number of smartphones most popular in Asian and African countries. Detection volumes are moderate, though we consider this a concerning threat given its pre-loaded nature and the fact that we are actively seeing detections of it around the world." + source = "https://blog.lookout.com/blog/2014/12/04/deathring/" + + condition: + androguard.service(/MainOsService/i) and + androguard.receiver(/ApkUninstallReceiver/i) +}