From 1dabb33f73c5094740871c2dd1c2092e16cf3910 Mon Sep 17 00:00:00 2001
From: KatsuragiCSL <44156690+KatsuragiCSL@users.noreply.github.com>
Date: Fri, 1 Apr 2022 17:12:35 +0800
Subject: [PATCH 1/3] pyinstaller on macos

---
 malware/MALW_Pyinstaller_OSX.yar | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 malware/MALW_Pyinstaller_OSX.yar

diff --git a/malware/MALW_Pyinstaller_OSX.yar b/malware/MALW_Pyinstaller_OSX.yar
new file mode 100644
index 0000000..766c111
--- /dev/null
+++ b/malware/MALW_Pyinstaller_OSX.yar
@@ -0,0 +1,15 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
+*/
+
+rule MachO_File_pyinstaller
+{
+    meta:
+        author = "KatsuragiCSL (https://katsuragicsl.github.io)"
+        description = "Detect Mach-O file produced by pyinstaller"
+    strings:
+        $a = "pyi-runtime-tmpdir"
+        $b = "pyi-bootloader-ignore-signals"
+    condition:
+        any of them
+}

From 8f0aad67ea019f1b50b9192e5e48929577febd28 Mon Sep 17 00:00:00 2001
From: KatsuragiCSL <44156690+KatsuragiCSL@users.noreply.github.com>
Date: Fri, 1 Apr 2022 17:14:33 +0800
Subject: [PATCH 2/3] Update index.yar

---
 index.yar | 1 +
 1 file changed, 1 insertion(+)

diff --git a/index.yar b/index.yar
index 476a184..0fb86c2 100644
--- a/index.yar
+++ b/index.yar
@@ -274,6 +274,7 @@ include "./malware/MALW_PubSab.yar"
 include "./malware/MALW_PurpleWave.yar"
 include "./malware/MALW_PyPI.yar"
 include "./malware/MALW_Pyinstaller.yar"
+include "./malware/MALW_Pyinstaller_OSX.yar"
 include "./malware/MALW_Quarian.yar"
 include "./malware/MALW_Rebirth_Vulcan_ELF.yar"
 include "./malware/MALW_Regsubdat.yar"

From 338389f0bca3cddb1a18d916eb1370621364c6ff Mon Sep 17 00:00:00 2001
From: KatsuragiCSL <44156690+KatsuragiCSL@users.noreply.github.com>
Date: Fri, 1 Apr 2022 17:14:59 +0800
Subject: [PATCH 3/3] Update malware_index.yar

---
 malware_index.yar | 1 +
 1 file changed, 1 insertion(+)

diff --git a/malware_index.yar b/malware_index.yar
index 6fb6500..212917d 100644
--- a/malware_index.yar
+++ b/malware_index.yar
@@ -215,6 +215,7 @@ include "./malware/MALW_PubSab.yar"
 include "./malware/MALW_PurpleWave.yar"
 include "./malware/MALW_PyPI.yar"
 include "./malware/MALW_Pyinstaller.yar"
+include "./malware/MALW_Pyinstaller_OSX.yar"
 include "./malware/MALW_Quarian.yar"
 include "./malware/MALW_Rebirth_Vulcan_ELF.yar"
 include "./malware/MALW_Regsubdat.yar"