From eca2af09e755f672de583d43fb0dcb746d2cef70 Mon Sep 17 00:00:00 2001 From: Xumeiquer Date: Wed, 8 Jan 2020 11:55:31 +0100 Subject: [PATCH] Mobile rules based on Androguard are now deprecated. Folders were renamed. Index regenerated. --- .travis.yml | 36 ++-- Antidebug_AntiVM_index.yar | 4 +- CVE_Rules_index.yar | 30 +-- Capabilities_index.yar | 4 +- Crypto_index.yar | 4 +- Exploit-Kits_index.yar | 15 -- Malicious_Documents_index.yar | 23 --- Mobile_Malware_index.yar | 65 +----- Packers_index.yar | 12 +- README.md | 13 +- Webshells_index.yar | 18 +- .../Android_ASSDdeveloper.yar | 0 .../Android_AVITOMMS.yar | 0 .../Android_AliPay_smsStealer.yar | 0 .../Android_Amtrckr_20160519.yar | 0 .../Android_Backdoor.yar | 0 .../Android_Backdoor_script.yar | 0 .../Android_BadMirror.yar | 0 .../Android_Banker_Acecard.yar | 0 .../Android_BatteryBot_ClickFraud.yar | 0 .../Android_Clicker_G.yar | 0 .../Android_Copy9.yar | 0 .../Android_DeathRing.yar | 0 .../Android_Dectus_rswm.yar | 0 .../Android_Dendroid_RAT.yar | 0 .../Android_Dogspectus.yar | 0 .../Android_FakeApps.yar | 0 .../Android_FakeBank_Fanta.yar | 0 .../Android_Godless.yar | 0 .../Android_HackintTeam_Implant.yar | 0 .../Android_Libyan_Scorpions.yar | 0 .../Android_MalwareCertificates.yar | 0 .../Android_Malware_Ramsonware.yar | 0 .../Android_Malware_Tinhvan.yar | 0 .../Android_Malware_Towelroot.yar | 0 .../Android_Marcher_2.yar | 0 .../Android_MazarBot_z.yar | 0 .../Android_Metasploit.yar | 0 .../Android_Metasploit_Payload.yar | 0 .../Android_OmniRat.yar | 0 .../Android_Overlayer.yar | 0 .../Android_Pink_Locker.yar | 0 .../Android_Polish_Bankbot.yar | 0 .../Android_RuMMS.yar | 0 .../Android_SMSFraud.yar | 0 .../Android_SandroRat.yar | 0 .../Android_SlemBunk.yar | 0 .../Android_SpyAgent.yar | 0 .../Android_SpyNote.yar | 0 .../Android_Spynet.yar | 0 .../Android_Spywaller.yar | 0 .../Android_Switcher.yar | 0 .../Android_Tachi.yar | 0 .../Android_Tempting_Cedar_Spyware.yar | 0 .../Android_Tordow.yar | 0 .../Android_Triada_Banking.yar | 0 .../Android_Trojan_Dendroid.yar | 0 .../Android_Trojan_Droidjack.yar | 0 .../Android_VikingOrder.yar | 0 .../Android_VirusPolicia.yar | 0 .../Android_adware.yar | 0 .../Android_fake_mario_app | 0 .../Android_generic_adware.yar | 0 .../Android_generic_smsfraud.yar | 0 .../Android_malware_Advertising.yar | 0 .../Android_malware_ChinesePorn.yar | 0 .../Android_malware_Dropper.yar | 0 .../Android_malware_Fake_MosKow.yar | 0 .../Android_malware_HackingTeam.yar | 0 .../Android_malware_SMSsender.yar | 0 .../Android_malware_banker.yar | 0 .../Android_malware_xbot007.yar | 0 .../Android_mapin.yar | 0 .../Android_pornClicker.yar | 0 .../Android_sk_bankTr.yar | 0 email_index.yar | 2 +- {Exploit-Kits => exploit_kits}/EK_Angler.yar | 0 .../EK_Blackhole.yar | 0 .../EK_BleedingLife.yar | 0 .../EK_Crimepack.yar | 0 .../EK_Eleonore.yar | 0 {Exploit-Kits => exploit_kits}/EK_Fragus.yar | 0 {Exploit-Kits => exploit_kits}/EK_Phoenix.yar | 0 {Exploit-Kits => exploit_kits}/EK_Sakura.yar | 0 .../EK_ZeroAcces.yar | 0 {Exploit-Kits => exploit_kits}/EK_Zerox88.yar | 0 {Exploit-Kits => exploit_kits}/EK_Zeus.yar | 0 exploit_kits_index.yar | 15 ++ index.yar | 124 ++++++------ index_gen.sh | 5 +- index_w_mobile.yar | 187 ++++++------------ .../Maldoc_APT10_MenuPass.yar | 0 .../Maldoc_APT19_CVE-2017-1099.yar | 0 .../Maldoc_APT_OLE_JSRat.yar | 0 .../Maldoc_CVE-2017-0199.yar | 0 .../Maldoc_CVE_2017_11882.yar | 0 .../Maldoc_CVE_2017_8759.yar | 0 .../Maldoc_Contains_VBE_File.yar | 0 .../Maldoc_DDE.yar | 0 .../Maldoc_Dridex.yar | 0 .../Maldoc_Hidden_PE_file.yar | 0 .../Maldoc_MIME_ActiveMime_b64.yar | 0 .../Maldoc_PDF.yar | 0 .../Maldoc_PowerPointMouse.yar | 0 .../Maldoc_Suspicious_OLE_target.yar | 0 .../Maldoc_UserForm.yar | 0 .../Maldoc_VBA_macro_code.yar | 0 .../Maldoc_Word_2007_XML_Flat_OPC.yar | 0 .../Maldoc_hancitor_dropper | 0 .../Maldoc_malrtf_ole2link.yar | 0 .../maldoc_somerules.yar | 0 maldocs_index.yar | 23 +++ malware_index.yar | 5 +- 113 files changed, 233 insertions(+), 352 deletions(-) delete mode 100644 Exploit-Kits_index.yar delete mode 100644 Malicious_Documents_index.yar rename {Mobile_Malware => deprecated}/Android_ASSDdeveloper.yar (100%) rename {Mobile_Malware => deprecated}/Android_AVITOMMS.yar (100%) rename {Mobile_Malware => deprecated}/Android_AliPay_smsStealer.yar (100%) rename {Mobile_Malware => deprecated}/Android_Amtrckr_20160519.yar (100%) rename {Mobile_Malware => deprecated}/Android_Backdoor.yar (100%) rename {Mobile_Malware => deprecated}/Android_Backdoor_script.yar (100%) rename {Mobile_Malware => deprecated}/Android_BadMirror.yar (100%) rename {Mobile_Malware => deprecated}/Android_Banker_Acecard.yar (100%) rename {Mobile_Malware => deprecated}/Android_BatteryBot_ClickFraud.yar (100%) rename {Mobile_Malware => deprecated}/Android_Clicker_G.yar (100%) rename {Mobile_Malware => deprecated}/Android_Copy9.yar (100%) rename {Mobile_Malware => deprecated}/Android_DeathRing.yar (100%) rename {Mobile_Malware => deprecated}/Android_Dectus_rswm.yar (100%) rename {Mobile_Malware => deprecated}/Android_Dendroid_RAT.yar (100%) rename {Mobile_Malware => deprecated}/Android_Dogspectus.yar (100%) rename {Mobile_Malware => deprecated}/Android_FakeApps.yar (100%) rename {Mobile_Malware => deprecated}/Android_FakeBank_Fanta.yar (100%) rename {Mobile_Malware => deprecated}/Android_Godless.yar (100%) rename {Mobile_Malware => deprecated}/Android_HackintTeam_Implant.yar (100%) rename {Mobile_Malware => deprecated}/Android_Libyan_Scorpions.yar (100%) rename {Mobile_Malware => deprecated}/Android_MalwareCertificates.yar (100%) rename {Mobile_Malware => deprecated}/Android_Malware_Ramsonware.yar (100%) rename {Mobile_Malware => deprecated}/Android_Malware_Tinhvan.yar (100%) rename {Mobile_Malware => deprecated}/Android_Malware_Towelroot.yar (100%) rename {Mobile_Malware => deprecated}/Android_Marcher_2.yar (100%) rename {Mobile_Malware => deprecated}/Android_MazarBot_z.yar (100%) rename {Mobile_Malware => deprecated}/Android_Metasploit.yar (100%) rename {Mobile_Malware => deprecated}/Android_Metasploit_Payload.yar (100%) rename {Mobile_Malware => deprecated}/Android_OmniRat.yar (100%) rename {Mobile_Malware => deprecated}/Android_Overlayer.yar (100%) rename {Mobile_Malware => deprecated}/Android_Pink_Locker.yar (100%) rename {Mobile_Malware => deprecated}/Android_Polish_Bankbot.yar (100%) rename {Mobile_Malware => deprecated}/Android_RuMMS.yar (100%) rename {Mobile_Malware => deprecated}/Android_SMSFraud.yar (100%) rename {Mobile_Malware => deprecated}/Android_SandroRat.yar (100%) rename {Mobile_Malware => deprecated}/Android_SlemBunk.yar (100%) rename {Mobile_Malware => deprecated}/Android_SpyAgent.yar (100%) rename {Mobile_Malware => deprecated}/Android_SpyNote.yar (100%) rename {Mobile_Malware => deprecated}/Android_Spynet.yar (100%) rename {Mobile_Malware => deprecated}/Android_Spywaller.yar (100%) rename {Mobile_Malware => deprecated}/Android_Switcher.yar (100%) rename {Mobile_Malware => deprecated}/Android_Tachi.yar (100%) rename {Mobile_Malware => deprecated}/Android_Tempting_Cedar_Spyware.yar (100%) rename {Mobile_Malware => deprecated}/Android_Tordow.yar (100%) rename {Mobile_Malware => deprecated}/Android_Triada_Banking.yar (100%) rename {Mobile_Malware => deprecated}/Android_Trojan_Dendroid.yar (100%) rename {Mobile_Malware => deprecated}/Android_Trojan_Droidjack.yar (100%) rename {Mobile_Malware => deprecated}/Android_VikingOrder.yar (100%) rename {Mobile_Malware => deprecated}/Android_VirusPolicia.yar (100%) rename {Mobile_Malware => deprecated}/Android_adware.yar (100%) rename {Mobile_Malware => deprecated}/Android_fake_mario_app (100%) rename {Mobile_Malware => deprecated}/Android_generic_adware.yar (100%) rename {Mobile_Malware => deprecated}/Android_generic_smsfraud.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_Advertising.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_ChinesePorn.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_Dropper.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_Fake_MosKow.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_HackingTeam.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_SMSsender.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_banker.yar (100%) rename {Mobile_Malware => deprecated}/Android_malware_xbot007.yar (100%) rename {Mobile_Malware => deprecated}/Android_mapin.yar (100%) rename {Mobile_Malware => deprecated}/Android_pornClicker.yar (100%) rename {Mobile_Malware => deprecated}/Android_sk_bankTr.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Angler.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Blackhole.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_BleedingLife.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Crimepack.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Eleonore.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Fragus.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Phoenix.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Sakura.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_ZeroAcces.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Zerox88.yar (100%) rename {Exploit-Kits => exploit_kits}/EK_Zeus.yar (100%) create mode 100644 exploit_kits_index.yar rename {Malicious_Documents => maldocs}/Maldoc_APT10_MenuPass.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_APT19_CVE-2017-1099.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_APT_OLE_JSRat.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_CVE-2017-0199.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_CVE_2017_11882.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_CVE_2017_8759.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_Contains_VBE_File.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_DDE.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_Dridex.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_Hidden_PE_file.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_MIME_ActiveMime_b64.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_PDF.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_PowerPointMouse.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_Suspicious_OLE_target.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_UserForm.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_VBA_macro_code.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_Word_2007_XML_Flat_OPC.yar (100%) rename {Malicious_Documents => maldocs}/Maldoc_hancitor_dropper (100%) rename {Malicious_Documents => maldocs}/Maldoc_malrtf_ole2link.yar (100%) rename {Malicious_Documents => maldocs}/maldoc_somerules.yar (100%) create mode 100644 maldocs_index.yar diff --git a/.travis.yml b/.travis.yml index 8be5bd4..988a23a 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,32 +1,30 @@ language: c sudo: required -#dist: trusty + before_install: - sudo apt-get -qq update - - sudo apt-get install jq + - sudo apt-get install -y \ + automake \ + libtool \ + make \ + gcc \ + pkg-config \ + flex \ + bison \ + libjansson-dev \ + libmagic-dev \ + libssl-dev \ + jq # Yara - wget $(curl -s https://api.github.com/repos/VirusTotal/yara/releases/latest | jq -r ".tarball_url") -O yara.tar.gz - #- wget $(wget -O - https://api.github.com/repos/VirusTotal/yara/releases/9250110 | jq -r ".tarball_url") -O yara.tar.gz - mkdir yara - tar -C yara -xzvf yara.tar.gz --strip-components 1 -# Androguard for Yara - - wget https://raw.githubusercontent.com/Koodous/androguard-yara/master/androguard.c -O yara/libyara/modules/androguard.c - - wget https://raw.githubusercontent.com/Koodous/androguard-yara/master/dist/yara-3.7.0/libyara/modules/module_list -O yara/libyara/modules/module_list - - wget https://raw.githubusercontent.com/Koodous/androguard-yara/master/dist/yara-3.7.0/libyara/Makefile.am -O yara/libyara/Makefile.am -# libjansson - - wget http://www.digip.org/jansson/releases/jansson-2.7.tar.gz - - tar -xzvf jansson-2.7.tar.gz - - cd jansson-2.7 - - ./configure - - make - - sudo make install - # Compile Yara - cd ../yara # Update per issue 176 - - sed -i 's/#define RE_MAX_SPLIT_ID 128/#define RE_MAX_SPLIT_ID 255/g' libyara/re.c + - sed -i 's/#define RE_MAX_SPLIT_ID 128/#define RE_MAX_SPLIT_ID 255/g' libyara/include/yara/limits.h - ./bootstrap.sh - - ./configure --enable-cuckoo + - ./configure --enable-cuckoo --enable-magic --with-crypto - make - sudo make install - sudo ldconfig @@ -34,8 +32,6 @@ before_install: script: - echo "test" > testfile - - echo "{}" > androguard_report.json - FALLO=0 -# - for j in $(ls -d */); do for i in $(find $j -type f -name "*.yara" ; find $j -type f -name "*.yar"); do echo $i; yara -x androguard=androguard_report.json $i testfile; if [[ $? -ne 0 ]]; then FALLO=1; fi; done; done - - for i in $(ls *_index.yar); do echo $i; yara -w -x androguard=androguard_report.json $i testfile; if [[ $? -ne 0 ]]; then FALLO=1; fi; done + - for i in $(ls *_index.yar); do echo $i; yara -w $i testfile; if [[ $? -ne 0 ]]; then FALLO=1; fi; done - exit $FALLO diff --git a/Antidebug_AntiVM_index.yar b/Antidebug_AntiVM_index.yar index 6e0e982..f63e1f5 100644 --- a/Antidebug_AntiVM_index.yar +++ b/Antidebug_AntiVM_index.yar @@ -1,5 +1,5 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Antidebug_AntiVM/antidebug_antivm.yar" +include "./antidebug_antivm/antidebug_antivm.yar" diff --git a/CVE_Rules_index.yar b/CVE_Rules_index.yar index df2298f..cfc0837 100644 --- a/CVE_Rules_index.yar +++ b/CVE_Rules_index.yar @@ -1,18 +1,18 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./CVE_Rules/CVE-2010-0805.yar" -include "./CVE_Rules/CVE-2010-0887.yar" -include "./CVE_Rules/CVE-2010-1297.yar" -include "./CVE_Rules/CVE-2012-0158.yar" -include "./CVE_Rules/CVE-2013-0074.yar" -include "./CVE_Rules/CVE-2013-0422.yar" -include "./CVE_Rules/CVE-2015-1701.yar" -include "./CVE_Rules/CVE-2015-2426.yar" -include "./CVE_Rules/CVE-2015-2545.yar" -include "./CVE_Rules/CVE-2015-5119.yar" -include "./CVE_Rules/CVE-2016-5195.yar" -include "./CVE_Rules/CVE-2017-11882.yar" -include "./CVE_Rules/CVE-2018-20250.yar" -include "./CVE_Rules/CVE-2018-4878.yar" +include "./cve_rules/CVE-2010-0805.yar" +include "./cve_rules/CVE-2010-0887.yar" +include "./cve_rules/CVE-2010-1297.yar" +include "./cve_rules/CVE-2012-0158.yar" +include "./cve_rules/CVE-2013-0074.yar" +include "./cve_rules/CVE-2013-0422.yar" +include "./cve_rules/CVE-2015-1701.yar" +include "./cve_rules/CVE-2015-2426.yar" +include "./cve_rules/CVE-2015-2545.yar" +include "./cve_rules/CVE-2015-5119.yar" +include "./cve_rules/CVE-2016-5195.yar" +include "./cve_rules/CVE-2017-11882.yar" +include "./cve_rules/CVE-2018-20250.yar" +include "./cve_rules/CVE-2018-4878.yar" diff --git a/Capabilities_index.yar b/Capabilities_index.yar index 42a7f69..5cbc302 100644 --- a/Capabilities_index.yar +++ b/Capabilities_index.yar @@ -1,5 +1,5 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Capabilities/capabilities.yar" +include "./capabilities/capabilities.yar" diff --git a/Crypto_index.yar b/Crypto_index.yar index 7f6d67e..07a71f6 100644 --- a/Crypto_index.yar +++ b/Crypto_index.yar @@ -1,5 +1,5 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Crypto/crypto_signatures.yar" +include "./crypto/crypto_signatures.yar" diff --git a/Exploit-Kits_index.yar b/Exploit-Kits_index.yar deleted file mode 100644 index 3b292b3..0000000 --- a/Exploit-Kits_index.yar +++ /dev/null @@ -1,15 +0,0 @@ -/* -Generated by Yara-Rules -On 26-11-2019 -*/ -include "./Exploit-Kits/EK_Angler.yar" -include "./Exploit-Kits/EK_Blackhole.yar" -include "./Exploit-Kits/EK_BleedingLife.yar" -include "./Exploit-Kits/EK_Crimepack.yar" -include "./Exploit-Kits/EK_Eleonore.yar" -include "./Exploit-Kits/EK_Fragus.yar" -include "./Exploit-Kits/EK_Phoenix.yar" -include "./Exploit-Kits/EK_Sakura.yar" -include "./Exploit-Kits/EK_ZeroAcces.yar" -include "./Exploit-Kits/EK_Zerox88.yar" -include "./Exploit-Kits/EK_Zeus.yar" diff --git a/Malicious_Documents_index.yar b/Malicious_Documents_index.yar deleted file mode 100644 index 8e633ec..0000000 --- a/Malicious_Documents_index.yar +++ /dev/null @@ -1,23 +0,0 @@ -/* -Generated by Yara-Rules -On 26-11-2019 -*/ -include "./Malicious_Documents/Maldoc_APT10_MenuPass.yar" -include "./Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar" -include "./Malicious_Documents/Maldoc_APT_OLE_JSRat.yar" -include "./Malicious_Documents/Maldoc_CVE-2017-0199.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_11882.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_8759.yar" -include "./Malicious_Documents/Maldoc_Contains_VBE_File.yar" -include "./Malicious_Documents/Maldoc_DDE.yar" -include "./Malicious_Documents/Maldoc_Dridex.yar" -include "./Malicious_Documents/Maldoc_Hidden_PE_file.yar" -include "./Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar" -include "./Malicious_Documents/Maldoc_PDF.yar" -include "./Malicious_Documents/Maldoc_PowerPointMouse.yar" -include "./Malicious_Documents/Maldoc_Suspicious_OLE_target.yar" -include "./Malicious_Documents/Maldoc_UserForm.yar" -include "./Malicious_Documents/Maldoc_VBA_macro_code.yar" -include "./Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar" -include "./Malicious_Documents/Maldoc_malrtf_ole2link.yar" -include "./Malicious_Documents/maldoc_somerules.yar" diff --git a/Mobile_Malware_index.yar b/Mobile_Malware_index.yar index 3f9cf75..46ff07c 100644 --- a/Mobile_Malware_index.yar +++ b/Mobile_Malware_index.yar @@ -1,67 +1,4 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Mobile_Malware/Android_ASSDdeveloper.yar" -include "./Mobile_Malware/Android_AVITOMMS.yar" -include "./Mobile_Malware/Android_AliPay_smsStealer.yar" -include "./Mobile_Malware/Android_Amtrckr_20160519.yar" -include "./Mobile_Malware/Android_Backdoor.yar" -include "./Mobile_Malware/Android_Backdoor_script.yar" -include "./Mobile_Malware/Android_BadMirror.yar" -include "./Mobile_Malware/Android_Banker_Acecard.yar" -include "./Mobile_Malware/Android_BatteryBot_ClickFraud.yar" -include "./Mobile_Malware/Android_Clicker_G.yar" -include "./Mobile_Malware/Android_Copy9.yar" -include "./Mobile_Malware/Android_DeathRing.yar" -include "./Mobile_Malware/Android_Dectus_rswm.yar" -include "./Mobile_Malware/Android_Dendroid_RAT.yar" -include "./Mobile_Malware/Android_Dogspectus.yar" -include "./Mobile_Malware/Android_FakeApps.yar" -include "./Mobile_Malware/Android_FakeBank_Fanta.yar" -include "./Mobile_Malware/Android_Godless.yar" -include "./Mobile_Malware/Android_HackintTeam_Implant.yar" -include "./Mobile_Malware/Android_Libyan_Scorpions.yar" -include "./Mobile_Malware/Android_MalwareCertificates.yar" -include "./Mobile_Malware/Android_Malware_Ramsonware.yar" -include "./Mobile_Malware/Android_Malware_Tinhvan.yar" -include "./Mobile_Malware/Android_Malware_Towelroot.yar" -include "./Mobile_Malware/Android_Marcher_2.yar" -include "./Mobile_Malware/Android_MazarBot_z.yar" -include "./Mobile_Malware/Android_Metasploit.yar" -include "./Mobile_Malware/Android_Metasploit_Payload.yar" -include "./Mobile_Malware/Android_OmniRat.yar" -include "./Mobile_Malware/Android_Overlayer.yar" -include "./Mobile_Malware/Android_Pink_Locker.yar" -include "./Mobile_Malware/Android_Polish_Bankbot.yar" -include "./Mobile_Malware/Android_RuMMS.yar" -include "./Mobile_Malware/Android_SMSFraud.yar" -include "./Mobile_Malware/Android_SandroRat.yar" -include "./Mobile_Malware/Android_SlemBunk.yar" -include "./Mobile_Malware/Android_SpyAgent.yar" -include "./Mobile_Malware/Android_SpyNote.yar" -include "./Mobile_Malware/Android_Spynet.yar" -include "./Mobile_Malware/Android_Spywaller.yar" -include "./Mobile_Malware/Android_Switcher.yar" -include "./Mobile_Malware/Android_Tachi.yar" -include "./Mobile_Malware/Android_Tempting_Cedar_Spyware.yar" -include "./Mobile_Malware/Android_Tordow.yar" -include "./Mobile_Malware/Android_Triada_Banking.yar" -include "./Mobile_Malware/Android_Trojan_Dendroid.yar" -include "./Mobile_Malware/Android_Trojan_Droidjack.yar" -include "./Mobile_Malware/Android_VikingOrder.yar" -include "./Mobile_Malware/Android_VirusPolicia.yar" -include "./Mobile_Malware/Android_adware.yar" -include "./Mobile_Malware/Android_generic_adware.yar" -include "./Mobile_Malware/Android_generic_smsfraud.yar" -include "./Mobile_Malware/Android_malware_Advertising.yar" -include "./Mobile_Malware/Android_malware_ChinesePorn.yar" -include "./Mobile_Malware/Android_malware_Dropper.yar" -include "./Mobile_Malware/Android_malware_Fake_MosKow.yar" -include "./Mobile_Malware/Android_malware_HackingTeam.yar" -include "./Mobile_Malware/Android_malware_SMSsender.yar" -include "./Mobile_Malware/Android_malware_banker.yar" -include "./Mobile_Malware/Android_malware_xbot007.yar" -include "./Mobile_Malware/Android_mapin.yar" -include "./Mobile_Malware/Android_pornClicker.yar" -include "./Mobile_Malware/Android_sk_bankTr.yar" diff --git a/Packers_index.yar b/Packers_index.yar index f7d3e99..8f349ba 100644 --- a/Packers_index.yar +++ b/Packers_index.yar @@ -1,9 +1,9 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Packers/JJencode.yar" -include "./Packers/Javascript_exploit_and_obfuscation.yar" -include "./Packers/packer.yar" -include "./Packers/packer_compiler_signatures.yar" -include "./Packers/peid.yar" +include "./packers/JJencode.yar" +include "./packers/Javascript_exploit_and_obfuscation.yar" +include "./packers/packer.yar" +include "./packers/packer_compiler_signatures.yar" +include "./packers/peid.yar" diff --git a/README.md b/README.md index 986d85f..e93adb1 100644 --- a/README.md +++ b/README.md @@ -14,8 +14,6 @@ If you’re interested in sharing your Yara rules with us and the Security Commu Twitter account: https://twitter.com/yararules -Mailing list : http://list.yararules.com/mailman/listinfo/yararules.com.signatures - # Requirements Yara **version 3.0** or higher is required for most of our rules to work. This is mainly due to the use of the "pe" module introduced in that version. @@ -24,7 +22,9 @@ You can check your installed version with `yara -v` Packages available in Ubuntu 14.04 LTS default repositories are too old. You can alternatively install from source or use the packages available in the [Remnux repository](https://launchpad.net/~remnux/+archive/ubuntu/stable). -Also, you will need [Androguard Module](https://github.com/Koodous/androguard-yara) if you want to use the rules in the 'mobile_malware' category. +~~Also, you will need [Androguard Module](https://github.com/Koodous/androguard-yara) if you want to use the rules in the 'mobile_malware' category.~~ + +We have deprecated mobile_malware rules that depend on Androguard Module because it seems an abandoned project. # Categories @@ -36,7 +36,7 @@ In this section you will find Yara Rules aimed toward the detection of anti-debu In this section you will find Yara rules to detect capabilities that do not fit into any of the other categories. They are useful to know for analysis but may not be malicious indicators on their own. -## CVE_Rules +## CVE Rules In this section you will find Yara Rules specialised toward the identification of specific Common Vulnerabilities and Exposures (CVEs) @@ -72,9 +72,9 @@ In this section you will find Yara rules specialised toward the identification o In this section you will find Yara rules specialised toward the identification of well-known mobile malware. -Many rules in this section use the Androguard module developed by the people over at https://koodous.com/. +## Deprecated -You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara +In this section you will find Yara rules deprecated. # Contact @@ -82,4 +82,3 @@ Webpage: http://yararules.com Twitter account: https://twitter.com/yararules -Mail list : http://list.yararules.com/mailman/listinfo/yararules.com.signatures diff --git a/Webshells_index.yar b/Webshells_index.yar index 10427de..43bd69d 100644 --- a/Webshells_index.yar +++ b/Webshells_index.yar @@ -1,12 +1,12 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Webshells/WShell_APT_Laudanum.yar" -include "./Webshells/WShell_ASPXSpy.yar" -include "./Webshells/WShell_PHP_Anuna.yar" -include "./Webshells/WShell_PHP_in_images.yar" -include "./Webshells/WShell_THOR_Webshells.yar" -include "./Webshells/Wshell_ChineseSpam.yar" -include "./Webshells/Wshell_fire2013.yar" -include "./Webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_APT_Laudanum.yar" +include "./webshells/WShell_ASPXSpy.yar" +include "./webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_PHP_Anuna.yar" +include "./webshells/WShell_PHP_in_images.yar" +include "./webshells/WShell_THOR_Webshells.yar" +include "./webshells/Wshell_ChineseSpam.yar" +include "./webshells/Wshell_fire2013.yar" diff --git a/Mobile_Malware/Android_ASSDdeveloper.yar b/deprecated/Android_ASSDdeveloper.yar similarity index 100% rename from Mobile_Malware/Android_ASSDdeveloper.yar rename to deprecated/Android_ASSDdeveloper.yar diff --git a/Mobile_Malware/Android_AVITOMMS.yar b/deprecated/Android_AVITOMMS.yar similarity index 100% rename from Mobile_Malware/Android_AVITOMMS.yar rename to deprecated/Android_AVITOMMS.yar diff --git a/Mobile_Malware/Android_AliPay_smsStealer.yar b/deprecated/Android_AliPay_smsStealer.yar similarity index 100% rename from Mobile_Malware/Android_AliPay_smsStealer.yar rename to deprecated/Android_AliPay_smsStealer.yar diff --git a/Mobile_Malware/Android_Amtrckr_20160519.yar b/deprecated/Android_Amtrckr_20160519.yar similarity index 100% rename from Mobile_Malware/Android_Amtrckr_20160519.yar rename to deprecated/Android_Amtrckr_20160519.yar diff --git a/Mobile_Malware/Android_Backdoor.yar b/deprecated/Android_Backdoor.yar similarity index 100% rename from Mobile_Malware/Android_Backdoor.yar rename to deprecated/Android_Backdoor.yar diff --git a/Mobile_Malware/Android_Backdoor_script.yar b/deprecated/Android_Backdoor_script.yar similarity index 100% rename from Mobile_Malware/Android_Backdoor_script.yar rename to deprecated/Android_Backdoor_script.yar diff --git a/Mobile_Malware/Android_BadMirror.yar b/deprecated/Android_BadMirror.yar similarity index 100% rename from Mobile_Malware/Android_BadMirror.yar rename to deprecated/Android_BadMirror.yar diff --git a/Mobile_Malware/Android_Banker_Acecard.yar b/deprecated/Android_Banker_Acecard.yar similarity index 100% rename from Mobile_Malware/Android_Banker_Acecard.yar rename to deprecated/Android_Banker_Acecard.yar diff --git a/Mobile_Malware/Android_BatteryBot_ClickFraud.yar b/deprecated/Android_BatteryBot_ClickFraud.yar similarity index 100% rename from Mobile_Malware/Android_BatteryBot_ClickFraud.yar rename to deprecated/Android_BatteryBot_ClickFraud.yar diff --git a/Mobile_Malware/Android_Clicker_G.yar b/deprecated/Android_Clicker_G.yar similarity index 100% rename from Mobile_Malware/Android_Clicker_G.yar rename to deprecated/Android_Clicker_G.yar diff --git a/Mobile_Malware/Android_Copy9.yar b/deprecated/Android_Copy9.yar similarity index 100% rename from Mobile_Malware/Android_Copy9.yar rename to deprecated/Android_Copy9.yar diff --git a/Mobile_Malware/Android_DeathRing.yar b/deprecated/Android_DeathRing.yar similarity index 100% rename from Mobile_Malware/Android_DeathRing.yar rename to deprecated/Android_DeathRing.yar diff --git a/Mobile_Malware/Android_Dectus_rswm.yar b/deprecated/Android_Dectus_rswm.yar similarity index 100% rename from Mobile_Malware/Android_Dectus_rswm.yar rename to deprecated/Android_Dectus_rswm.yar diff --git a/Mobile_Malware/Android_Dendroid_RAT.yar b/deprecated/Android_Dendroid_RAT.yar similarity index 100% rename from Mobile_Malware/Android_Dendroid_RAT.yar rename to deprecated/Android_Dendroid_RAT.yar diff --git a/Mobile_Malware/Android_Dogspectus.yar b/deprecated/Android_Dogspectus.yar similarity index 100% rename from Mobile_Malware/Android_Dogspectus.yar rename to deprecated/Android_Dogspectus.yar diff --git a/Mobile_Malware/Android_FakeApps.yar b/deprecated/Android_FakeApps.yar similarity index 100% rename from Mobile_Malware/Android_FakeApps.yar rename to deprecated/Android_FakeApps.yar diff --git a/Mobile_Malware/Android_FakeBank_Fanta.yar b/deprecated/Android_FakeBank_Fanta.yar similarity index 100% rename from Mobile_Malware/Android_FakeBank_Fanta.yar rename to deprecated/Android_FakeBank_Fanta.yar diff --git a/Mobile_Malware/Android_Godless.yar b/deprecated/Android_Godless.yar similarity index 100% rename from Mobile_Malware/Android_Godless.yar rename to deprecated/Android_Godless.yar diff --git a/Mobile_Malware/Android_HackintTeam_Implant.yar b/deprecated/Android_HackintTeam_Implant.yar similarity index 100% rename from Mobile_Malware/Android_HackintTeam_Implant.yar rename to deprecated/Android_HackintTeam_Implant.yar diff --git a/Mobile_Malware/Android_Libyan_Scorpions.yar b/deprecated/Android_Libyan_Scorpions.yar similarity index 100% rename from Mobile_Malware/Android_Libyan_Scorpions.yar rename to deprecated/Android_Libyan_Scorpions.yar diff --git a/Mobile_Malware/Android_MalwareCertificates.yar b/deprecated/Android_MalwareCertificates.yar similarity index 100% rename from Mobile_Malware/Android_MalwareCertificates.yar rename to deprecated/Android_MalwareCertificates.yar diff --git a/Mobile_Malware/Android_Malware_Ramsonware.yar b/deprecated/Android_Malware_Ramsonware.yar similarity index 100% rename from Mobile_Malware/Android_Malware_Ramsonware.yar rename to deprecated/Android_Malware_Ramsonware.yar diff --git a/Mobile_Malware/Android_Malware_Tinhvan.yar b/deprecated/Android_Malware_Tinhvan.yar similarity index 100% rename from Mobile_Malware/Android_Malware_Tinhvan.yar rename to deprecated/Android_Malware_Tinhvan.yar diff --git a/Mobile_Malware/Android_Malware_Towelroot.yar b/deprecated/Android_Malware_Towelroot.yar similarity index 100% rename from Mobile_Malware/Android_Malware_Towelroot.yar rename to deprecated/Android_Malware_Towelroot.yar diff --git a/Mobile_Malware/Android_Marcher_2.yar b/deprecated/Android_Marcher_2.yar similarity index 100% rename from Mobile_Malware/Android_Marcher_2.yar rename to deprecated/Android_Marcher_2.yar diff --git a/Mobile_Malware/Android_MazarBot_z.yar b/deprecated/Android_MazarBot_z.yar similarity index 100% rename from Mobile_Malware/Android_MazarBot_z.yar rename to deprecated/Android_MazarBot_z.yar diff --git a/Mobile_Malware/Android_Metasploit.yar b/deprecated/Android_Metasploit.yar similarity index 100% rename from Mobile_Malware/Android_Metasploit.yar rename to deprecated/Android_Metasploit.yar diff --git a/Mobile_Malware/Android_Metasploit_Payload.yar b/deprecated/Android_Metasploit_Payload.yar similarity index 100% rename from Mobile_Malware/Android_Metasploit_Payload.yar rename to deprecated/Android_Metasploit_Payload.yar diff --git a/Mobile_Malware/Android_OmniRat.yar b/deprecated/Android_OmniRat.yar similarity index 100% rename from Mobile_Malware/Android_OmniRat.yar rename to deprecated/Android_OmniRat.yar diff --git a/Mobile_Malware/Android_Overlayer.yar b/deprecated/Android_Overlayer.yar similarity index 100% rename from Mobile_Malware/Android_Overlayer.yar rename to deprecated/Android_Overlayer.yar diff --git a/Mobile_Malware/Android_Pink_Locker.yar b/deprecated/Android_Pink_Locker.yar similarity index 100% rename from Mobile_Malware/Android_Pink_Locker.yar rename to deprecated/Android_Pink_Locker.yar diff --git a/Mobile_Malware/Android_Polish_Bankbot.yar b/deprecated/Android_Polish_Bankbot.yar similarity index 100% rename from Mobile_Malware/Android_Polish_Bankbot.yar rename to deprecated/Android_Polish_Bankbot.yar diff --git a/Mobile_Malware/Android_RuMMS.yar b/deprecated/Android_RuMMS.yar similarity index 100% rename from Mobile_Malware/Android_RuMMS.yar rename to deprecated/Android_RuMMS.yar diff --git a/Mobile_Malware/Android_SMSFraud.yar b/deprecated/Android_SMSFraud.yar similarity index 100% rename from Mobile_Malware/Android_SMSFraud.yar rename to deprecated/Android_SMSFraud.yar diff --git a/Mobile_Malware/Android_SandroRat.yar b/deprecated/Android_SandroRat.yar similarity index 100% rename from Mobile_Malware/Android_SandroRat.yar rename to deprecated/Android_SandroRat.yar diff --git a/Mobile_Malware/Android_SlemBunk.yar b/deprecated/Android_SlemBunk.yar similarity index 100% rename from Mobile_Malware/Android_SlemBunk.yar rename to deprecated/Android_SlemBunk.yar diff --git a/Mobile_Malware/Android_SpyAgent.yar b/deprecated/Android_SpyAgent.yar similarity index 100% rename from Mobile_Malware/Android_SpyAgent.yar rename to deprecated/Android_SpyAgent.yar diff --git a/Mobile_Malware/Android_SpyNote.yar b/deprecated/Android_SpyNote.yar similarity index 100% rename from Mobile_Malware/Android_SpyNote.yar rename to deprecated/Android_SpyNote.yar diff --git a/Mobile_Malware/Android_Spynet.yar b/deprecated/Android_Spynet.yar similarity index 100% rename from Mobile_Malware/Android_Spynet.yar rename to deprecated/Android_Spynet.yar diff --git a/Mobile_Malware/Android_Spywaller.yar b/deprecated/Android_Spywaller.yar similarity index 100% rename from Mobile_Malware/Android_Spywaller.yar rename to deprecated/Android_Spywaller.yar diff --git a/Mobile_Malware/Android_Switcher.yar b/deprecated/Android_Switcher.yar similarity index 100% rename from Mobile_Malware/Android_Switcher.yar rename to deprecated/Android_Switcher.yar diff --git a/Mobile_Malware/Android_Tachi.yar b/deprecated/Android_Tachi.yar similarity index 100% rename from Mobile_Malware/Android_Tachi.yar rename to deprecated/Android_Tachi.yar diff --git a/Mobile_Malware/Android_Tempting_Cedar_Spyware.yar b/deprecated/Android_Tempting_Cedar_Spyware.yar similarity index 100% rename from Mobile_Malware/Android_Tempting_Cedar_Spyware.yar rename to deprecated/Android_Tempting_Cedar_Spyware.yar diff --git a/Mobile_Malware/Android_Tordow.yar b/deprecated/Android_Tordow.yar similarity index 100% rename from Mobile_Malware/Android_Tordow.yar rename to deprecated/Android_Tordow.yar diff --git a/Mobile_Malware/Android_Triada_Banking.yar b/deprecated/Android_Triada_Banking.yar similarity index 100% rename from Mobile_Malware/Android_Triada_Banking.yar rename to deprecated/Android_Triada_Banking.yar diff --git a/Mobile_Malware/Android_Trojan_Dendroid.yar b/deprecated/Android_Trojan_Dendroid.yar similarity index 100% rename from Mobile_Malware/Android_Trojan_Dendroid.yar rename to deprecated/Android_Trojan_Dendroid.yar diff --git a/Mobile_Malware/Android_Trojan_Droidjack.yar b/deprecated/Android_Trojan_Droidjack.yar similarity index 100% rename from Mobile_Malware/Android_Trojan_Droidjack.yar rename to deprecated/Android_Trojan_Droidjack.yar diff --git a/Mobile_Malware/Android_VikingOrder.yar b/deprecated/Android_VikingOrder.yar similarity index 100% rename from Mobile_Malware/Android_VikingOrder.yar rename to deprecated/Android_VikingOrder.yar diff --git a/Mobile_Malware/Android_VirusPolicia.yar b/deprecated/Android_VirusPolicia.yar similarity index 100% rename from Mobile_Malware/Android_VirusPolicia.yar rename to deprecated/Android_VirusPolicia.yar diff --git a/Mobile_Malware/Android_adware.yar b/deprecated/Android_adware.yar similarity index 100% rename from Mobile_Malware/Android_adware.yar rename to deprecated/Android_adware.yar diff --git a/Mobile_Malware/Android_fake_mario_app b/deprecated/Android_fake_mario_app similarity index 100% rename from Mobile_Malware/Android_fake_mario_app rename to deprecated/Android_fake_mario_app diff --git a/Mobile_Malware/Android_generic_adware.yar b/deprecated/Android_generic_adware.yar similarity index 100% rename from Mobile_Malware/Android_generic_adware.yar rename to deprecated/Android_generic_adware.yar diff --git a/Mobile_Malware/Android_generic_smsfraud.yar b/deprecated/Android_generic_smsfraud.yar similarity index 100% rename from Mobile_Malware/Android_generic_smsfraud.yar rename to deprecated/Android_generic_smsfraud.yar diff --git a/Mobile_Malware/Android_malware_Advertising.yar b/deprecated/Android_malware_Advertising.yar similarity index 100% rename from Mobile_Malware/Android_malware_Advertising.yar rename to deprecated/Android_malware_Advertising.yar diff --git a/Mobile_Malware/Android_malware_ChinesePorn.yar b/deprecated/Android_malware_ChinesePorn.yar similarity index 100% rename from Mobile_Malware/Android_malware_ChinesePorn.yar rename to deprecated/Android_malware_ChinesePorn.yar diff --git a/Mobile_Malware/Android_malware_Dropper.yar b/deprecated/Android_malware_Dropper.yar similarity index 100% rename from Mobile_Malware/Android_malware_Dropper.yar rename to deprecated/Android_malware_Dropper.yar diff --git a/Mobile_Malware/Android_malware_Fake_MosKow.yar b/deprecated/Android_malware_Fake_MosKow.yar similarity index 100% rename from Mobile_Malware/Android_malware_Fake_MosKow.yar rename to deprecated/Android_malware_Fake_MosKow.yar diff --git a/Mobile_Malware/Android_malware_HackingTeam.yar b/deprecated/Android_malware_HackingTeam.yar similarity index 100% rename from Mobile_Malware/Android_malware_HackingTeam.yar rename to deprecated/Android_malware_HackingTeam.yar diff --git a/Mobile_Malware/Android_malware_SMSsender.yar b/deprecated/Android_malware_SMSsender.yar similarity index 100% rename from Mobile_Malware/Android_malware_SMSsender.yar rename to deprecated/Android_malware_SMSsender.yar diff --git a/Mobile_Malware/Android_malware_banker.yar b/deprecated/Android_malware_banker.yar similarity index 100% rename from Mobile_Malware/Android_malware_banker.yar rename to deprecated/Android_malware_banker.yar diff --git a/Mobile_Malware/Android_malware_xbot007.yar b/deprecated/Android_malware_xbot007.yar similarity index 100% rename from Mobile_Malware/Android_malware_xbot007.yar rename to deprecated/Android_malware_xbot007.yar diff --git a/Mobile_Malware/Android_mapin.yar b/deprecated/Android_mapin.yar similarity index 100% rename from Mobile_Malware/Android_mapin.yar rename to deprecated/Android_mapin.yar diff --git a/Mobile_Malware/Android_pornClicker.yar b/deprecated/Android_pornClicker.yar similarity index 100% rename from Mobile_Malware/Android_pornClicker.yar rename to deprecated/Android_pornClicker.yar diff --git a/Mobile_Malware/Android_sk_bankTr.yar b/deprecated/Android_sk_bankTr.yar similarity index 100% rename from Mobile_Malware/Android_sk_bankTr.yar rename to deprecated/Android_sk_bankTr.yar diff --git a/email_index.yar b/email_index.yar index 6ba261b..af7140f 100644 --- a/email_index.yar +++ b/email_index.yar @@ -1,6 +1,6 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ include "./email/EMAIL_Cryptowall.yar" include "./email/attachment.yar" diff --git a/Exploit-Kits/EK_Angler.yar b/exploit_kits/EK_Angler.yar similarity index 100% rename from Exploit-Kits/EK_Angler.yar rename to exploit_kits/EK_Angler.yar diff --git a/Exploit-Kits/EK_Blackhole.yar b/exploit_kits/EK_Blackhole.yar similarity index 100% rename from Exploit-Kits/EK_Blackhole.yar rename to exploit_kits/EK_Blackhole.yar diff --git a/Exploit-Kits/EK_BleedingLife.yar b/exploit_kits/EK_BleedingLife.yar similarity index 100% rename from Exploit-Kits/EK_BleedingLife.yar rename to exploit_kits/EK_BleedingLife.yar diff --git a/Exploit-Kits/EK_Crimepack.yar b/exploit_kits/EK_Crimepack.yar similarity index 100% rename from Exploit-Kits/EK_Crimepack.yar rename to exploit_kits/EK_Crimepack.yar diff --git a/Exploit-Kits/EK_Eleonore.yar b/exploit_kits/EK_Eleonore.yar similarity index 100% rename from Exploit-Kits/EK_Eleonore.yar rename to exploit_kits/EK_Eleonore.yar diff --git a/Exploit-Kits/EK_Fragus.yar b/exploit_kits/EK_Fragus.yar similarity index 100% rename from Exploit-Kits/EK_Fragus.yar rename to exploit_kits/EK_Fragus.yar diff --git a/Exploit-Kits/EK_Phoenix.yar b/exploit_kits/EK_Phoenix.yar similarity index 100% rename from Exploit-Kits/EK_Phoenix.yar rename to exploit_kits/EK_Phoenix.yar diff --git a/Exploit-Kits/EK_Sakura.yar b/exploit_kits/EK_Sakura.yar similarity index 100% rename from Exploit-Kits/EK_Sakura.yar rename to exploit_kits/EK_Sakura.yar diff --git a/Exploit-Kits/EK_ZeroAcces.yar b/exploit_kits/EK_ZeroAcces.yar similarity index 100% rename from Exploit-Kits/EK_ZeroAcces.yar rename to exploit_kits/EK_ZeroAcces.yar diff --git a/Exploit-Kits/EK_Zerox88.yar b/exploit_kits/EK_Zerox88.yar similarity index 100% rename from Exploit-Kits/EK_Zerox88.yar rename to exploit_kits/EK_Zerox88.yar diff --git a/Exploit-Kits/EK_Zeus.yar b/exploit_kits/EK_Zeus.yar similarity index 100% rename from Exploit-Kits/EK_Zeus.yar rename to exploit_kits/EK_Zeus.yar diff --git a/exploit_kits_index.yar b/exploit_kits_index.yar new file mode 100644 index 0000000..37ac29c --- /dev/null +++ b/exploit_kits_index.yar @@ -0,0 +1,15 @@ +/* +Generated by Yara-Rules +On 08-01-2020 +*/ +include "./exploit_kits/EK_Angler.yar" +include "./exploit_kits/EK_Blackhole.yar" +include "./exploit_kits/EK_BleedingLife.yar" +include "./exploit_kits/EK_Crimepack.yar" +include "./exploit_kits/EK_Eleonore.yar" +include "./exploit_kits/EK_Fragus.yar" +include "./exploit_kits/EK_Phoenix.yar" +include "./exploit_kits/EK_Sakura.yar" +include "./exploit_kits/EK_ZeroAcces.yar" +include "./exploit_kits/EK_Zerox88.yar" +include "./exploit_kits/EK_Zeus.yar" diff --git a/index.yar b/index.yar index eb18499..18d41a4 100644 --- a/index.yar +++ b/index.yar @@ -1,66 +1,24 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Antidebug_AntiVM/antidebug_antivm.yar" -include "./CVE_Rules/CVE-2010-0805.yar" -include "./CVE_Rules/CVE-2010-0887.yar" -include "./CVE_Rules/CVE-2010-1297.yar" -include "./CVE_Rules/CVE-2012-0158.yar" -include "./CVE_Rules/CVE-2013-0074.yar" -include "./CVE_Rules/CVE-2013-0422.yar" -include "./CVE_Rules/CVE-2015-1701.yar" -include "./CVE_Rules/CVE-2015-2426.yar" -include "./CVE_Rules/CVE-2015-2545.yar" -include "./CVE_Rules/CVE-2015-5119.yar" -include "./CVE_Rules/CVE-2016-5195.yar" -include "./CVE_Rules/CVE-2017-11882.yar" -include "./CVE_Rules/CVE-2018-20250.yar" -include "./CVE_Rules/CVE-2018-4878.yar" -include "./Capabilities/capabilities.yar" -include "./Crypto/crypto_signatures.yar" -include "./Exploit-Kits/EK_Angler.yar" -include "./Exploit-Kits/EK_Blackhole.yar" -include "./Exploit-Kits/EK_BleedingLife.yar" -include "./Exploit-Kits/EK_Crimepack.yar" -include "./Exploit-Kits/EK_Eleonore.yar" -include "./Exploit-Kits/EK_Fragus.yar" -include "./Exploit-Kits/EK_Phoenix.yar" -include "./Exploit-Kits/EK_Sakura.yar" -include "./Exploit-Kits/EK_ZeroAcces.yar" -include "./Exploit-Kits/EK_Zerox88.yar" -include "./Exploit-Kits/EK_Zeus.yar" -include "./Malicious_Documents/Maldoc_APT10_MenuPass.yar" -include "./Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar" -include "./Malicious_Documents/Maldoc_APT_OLE_JSRat.yar" -include "./Malicious_Documents/Maldoc_CVE-2017-0199.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_11882.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_8759.yar" -include "./Malicious_Documents/Maldoc_Contains_VBE_File.yar" -include "./Malicious_Documents/Maldoc_DDE.yar" -include "./Malicious_Documents/Maldoc_Dridex.yar" -include "./Malicious_Documents/Maldoc_Hidden_PE_file.yar" -include "./Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar" -include "./Malicious_Documents/Maldoc_PDF.yar" -include "./Malicious_Documents/Maldoc_PowerPointMouse.yar" -include "./Malicious_Documents/Maldoc_Suspicious_OLE_target.yar" -include "./Malicious_Documents/Maldoc_UserForm.yar" -include "./Malicious_Documents/Maldoc_VBA_macro_code.yar" -include "./Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar" -include "./Malicious_Documents/Maldoc_malrtf_ole2link.yar" -include "./Malicious_Documents/maldoc_somerules.yar" -include "./Packers/JJencode.yar" -include "./Packers/Javascript_exploit_and_obfuscation.yar" -include "./Packers/packer.yar" -include "./Packers/packer_compiler_signatures.yar" -include "./Packers/peid.yar" -include "./Webshells/WShell_APT_Laudanum.yar" -include "./Webshells/WShell_ASPXSpy.yar" -include "./Webshells/WShell_PHP_Anuna.yar" -include "./Webshells/WShell_PHP_in_images.yar" -include "./Webshells/WShell_THOR_Webshells.yar" -include "./Webshells/Wshell_ChineseSpam.yar" -include "./Webshells/Wshell_fire2013.yar" +include "./antidebug_antivm/antidebug_antivm.yar" +include "./capabilities/capabilities.yar" +include "./crypto/crypto_signatures.yar" +include "./cve_rules/CVE-2010-0805.yar" +include "./cve_rules/CVE-2010-0887.yar" +include "./cve_rules/CVE-2010-1297.yar" +include "./cve_rules/CVE-2012-0158.yar" +include "./cve_rules/CVE-2013-0074.yar" +include "./cve_rules/CVE-2013-0422.yar" +include "./cve_rules/CVE-2015-1701.yar" +include "./cve_rules/CVE-2015-2426.yar" +include "./cve_rules/CVE-2015-2545.yar" +include "./cve_rules/CVE-2015-5119.yar" +include "./cve_rules/CVE-2016-5195.yar" +include "./cve_rules/CVE-2017-11882.yar" +include "./cve_rules/CVE-2018-20250.yar" +include "./cve_rules/CVE-2018-4878.yar" include "./email/EMAIL_Cryptowall.yar" include "./email/attachment.yar" include "./email/bank_rule.yar" @@ -68,6 +26,36 @@ include "./email/email_Ukraine_BE_powerattack.yar" include "./email/image.yar" include "./email/scam.yar" include "./email/urls.yar" +include "./exploit_kits/EK_Angler.yar" +include "./exploit_kits/EK_Blackhole.yar" +include "./exploit_kits/EK_BleedingLife.yar" +include "./exploit_kits/EK_Crimepack.yar" +include "./exploit_kits/EK_Eleonore.yar" +include "./exploit_kits/EK_Fragus.yar" +include "./exploit_kits/EK_Phoenix.yar" +include "./exploit_kits/EK_Sakura.yar" +include "./exploit_kits/EK_ZeroAcces.yar" +include "./exploit_kits/EK_Zerox88.yar" +include "./exploit_kits/EK_Zeus.yar" +include "./maldocs/Maldoc_APT10_MenuPass.yar" +include "./maldocs/Maldoc_APT19_CVE-2017-1099.yar" +include "./maldocs/Maldoc_APT_OLE_JSRat.yar" +include "./maldocs/Maldoc_CVE-2017-0199.yar" +include "./maldocs/Maldoc_CVE_2017_11882.yar" +include "./maldocs/Maldoc_CVE_2017_8759.yar" +include "./maldocs/Maldoc_Contains_VBE_File.yar" +include "./maldocs/Maldoc_DDE.yar" +include "./maldocs/Maldoc_Dridex.yar" +include "./maldocs/Maldoc_Hidden_PE_file.yar" +include "./maldocs/Maldoc_MIME_ActiveMime_b64.yar" +include "./maldocs/Maldoc_PDF.yar" +include "./maldocs/Maldoc_PowerPointMouse.yar" +include "./maldocs/Maldoc_Suspicious_OLE_target.yar" +include "./maldocs/Maldoc_UserForm.yar" +include "./maldocs/Maldoc_VBA_macro_code.yar" +include "./maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar" +include "./maldocs/Maldoc_malrtf_ole2link.yar" +include "./maldocs/maldoc_somerules.yar" include "./malware/000_common_rules.yar" include "./malware/APT_APT1.yar" include "./malware/APT_APT10.yar" @@ -204,6 +192,7 @@ include "./malware/MALW_Exploit_UAC_Elevators.yar" include "./malware/MALW_Ezcob.yar" include "./malware/MALW_F0xy.yar" include "./malware/MALW_FALLCHILL.yar" +include "./malware/MALW_FUDCrypt.yar" include "./malware/MALW_FakeM.yar" include "./malware/MALW_Fareit.yar" include "./malware/MALW_Favorite.yar" @@ -240,6 +229,7 @@ include "./malware/MALW_LinuxMoose.yar" include "./malware/MALW_LostDoor.yar" include "./malware/MALW_LuaBot.yar" include "./malware/MALW_LuckyCat.yar" +include "./malware/MALW_MSILStealer.yar" include "./malware/MALW_MacControl.yar" include "./malware/MALW_Madness.yar" include "./malware/MALW_Magento_backend.yar" @@ -390,6 +380,7 @@ include "./malware/RANSOM_GPGQwerty.yar" include "./malware/RANSOM_GoldenEye.yar" include "./malware/RANSOM_Locky.yar" include "./malware/RANSOM_MS17-010_Wannacrypt.yar" +include "./malware/RANSOM_Maze.yar" include "./malware/RANSOM_PetrWrap.yar" include "./malware/RANSOM_Petya.yar" include "./malware/RANSOM_SamSam.yar" @@ -443,3 +434,16 @@ include "./malware/TOOLKIT_Pwdump.yar" include "./malware/TOOLKIT_THOR_HackTools.yar" include "./malware/TOOLKIT_Wineggdrop.yar" include "./malware/TOOLKIT_exe2hex_payload.yar" +include "./packers/JJencode.yar" +include "./packers/Javascript_exploit_and_obfuscation.yar" +include "./packers/packer.yar" +include "./packers/packer_compiler_signatures.yar" +include "./packers/peid.yar" +include "./webshells/WShell_APT_Laudanum.yar" +include "./webshells/WShell_ASPXSpy.yar" +include "./webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_PHP_Anuna.yar" +include "./webshells/WShell_PHP_in_images.yar" +include "./webshells/WShell_THOR_Webshells.yar" +include "./webshells/Wshell_ChineseSpam.yar" +include "./webshells/Wshell_fire2013.yar" diff --git a/index_gen.sh b/index_gen.sh index e0a3469..d988a79 100755 --- a/index_gen.sh +++ b/index_gen.sh @@ -2,7 +2,8 @@ function get_folders { local INDECES=() - for folder in $(ls -d */ | grep -v utils); do + AVOID="utils|deprecated" + for folder in $(ls -d */ | grep -vE $AVOID); do INDECES+="$folder " done INDECES+=". " @@ -18,7 +19,7 @@ function gen_index { echo -e "/*$4*/" > $IDX_NAME fi OS=$(uname) - AVOID="_?index.yara?|index_|utils" + AVOID="_?index.yara?|index_|utils|deprecated" if [ x"$BASE" == x"." ]; then if [ $INC_MOBILE == false ]; then AVOID+="|Mobile" diff --git a/index_w_mobile.yar b/index_w_mobile.yar index 857c6e6..18d41a4 100644 --- a/index_w_mobile.yar +++ b/index_w_mobile.yar @@ -1,129 +1,24 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Antidebug_AntiVM/antidebug_antivm.yar" -include "./CVE_Rules/CVE-2010-0805.yar" -include "./CVE_Rules/CVE-2010-0887.yar" -include "./CVE_Rules/CVE-2010-1297.yar" -include "./CVE_Rules/CVE-2012-0158.yar" -include "./CVE_Rules/CVE-2013-0074.yar" -include "./CVE_Rules/CVE-2013-0422.yar" -include "./CVE_Rules/CVE-2015-1701.yar" -include "./CVE_Rules/CVE-2015-2426.yar" -include "./CVE_Rules/CVE-2015-2545.yar" -include "./CVE_Rules/CVE-2015-5119.yar" -include "./CVE_Rules/CVE-2016-5195.yar" -include "./CVE_Rules/CVE-2017-11882.yar" -include "./CVE_Rules/CVE-2018-20250.yar" -include "./CVE_Rules/CVE-2018-4878.yar" -include "./Capabilities/capabilities.yar" -include "./Crypto/crypto_signatures.yar" -include "./Exploit-Kits/EK_Angler.yar" -include "./Exploit-Kits/EK_Blackhole.yar" -include "./Exploit-Kits/EK_BleedingLife.yar" -include "./Exploit-Kits/EK_Crimepack.yar" -include "./Exploit-Kits/EK_Eleonore.yar" -include "./Exploit-Kits/EK_Fragus.yar" -include "./Exploit-Kits/EK_Phoenix.yar" -include "./Exploit-Kits/EK_Sakura.yar" -include "./Exploit-Kits/EK_ZeroAcces.yar" -include "./Exploit-Kits/EK_Zerox88.yar" -include "./Exploit-Kits/EK_Zeus.yar" -include "./Malicious_Documents/Maldoc_APT10_MenuPass.yar" -include "./Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar" -include "./Malicious_Documents/Maldoc_APT_OLE_JSRat.yar" -include "./Malicious_Documents/Maldoc_CVE-2017-0199.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_11882.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_8759.yar" -include "./Malicious_Documents/Maldoc_Contains_VBE_File.yar" -include "./Malicious_Documents/Maldoc_DDE.yar" -include "./Malicious_Documents/Maldoc_Dridex.yar" -include "./Malicious_Documents/Maldoc_Hidden_PE_file.yar" -include "./Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar" -include "./Malicious_Documents/Maldoc_PDF.yar" -include "./Malicious_Documents/Maldoc_PowerPointMouse.yar" -include "./Malicious_Documents/Maldoc_Suspicious_OLE_target.yar" -include "./Malicious_Documents/Maldoc_UserForm.yar" -include "./Malicious_Documents/Maldoc_VBA_macro_code.yar" -include "./Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar" -include "./Malicious_Documents/Maldoc_malrtf_ole2link.yar" -include "./Malicious_Documents/maldoc_somerules.yar" -include "./Mobile_Malware/Android_ASSDdeveloper.yar" -include "./Mobile_Malware/Android_AVITOMMS.yar" -include "./Mobile_Malware/Android_AliPay_smsStealer.yar" -include "./Mobile_Malware/Android_Amtrckr_20160519.yar" -include "./Mobile_Malware/Android_Backdoor.yar" -include "./Mobile_Malware/Android_Backdoor_script.yar" -include "./Mobile_Malware/Android_BadMirror.yar" -include "./Mobile_Malware/Android_Banker_Acecard.yar" -include "./Mobile_Malware/Android_BatteryBot_ClickFraud.yar" -include "./Mobile_Malware/Android_Clicker_G.yar" -include "./Mobile_Malware/Android_Copy9.yar" -include "./Mobile_Malware/Android_DeathRing.yar" -include "./Mobile_Malware/Android_Dectus_rswm.yar" -include "./Mobile_Malware/Android_Dendroid_RAT.yar" -include "./Mobile_Malware/Android_Dogspectus.yar" -include "./Mobile_Malware/Android_FakeApps.yar" -include "./Mobile_Malware/Android_FakeBank_Fanta.yar" -include "./Mobile_Malware/Android_Godless.yar" -include "./Mobile_Malware/Android_HackintTeam_Implant.yar" -include "./Mobile_Malware/Android_Libyan_Scorpions.yar" -include "./Mobile_Malware/Android_MalwareCertificates.yar" -include "./Mobile_Malware/Android_Malware_Ramsonware.yar" -include "./Mobile_Malware/Android_Malware_Tinhvan.yar" -include "./Mobile_Malware/Android_Malware_Towelroot.yar" -include "./Mobile_Malware/Android_Marcher_2.yar" -include "./Mobile_Malware/Android_MazarBot_z.yar" -include "./Mobile_Malware/Android_Metasploit.yar" -include "./Mobile_Malware/Android_Metasploit_Payload.yar" -include "./Mobile_Malware/Android_OmniRat.yar" -include "./Mobile_Malware/Android_Overlayer.yar" -include "./Mobile_Malware/Android_Pink_Locker.yar" -include "./Mobile_Malware/Android_Polish_Bankbot.yar" -include "./Mobile_Malware/Android_RuMMS.yar" -include "./Mobile_Malware/Android_SMSFraud.yar" -include "./Mobile_Malware/Android_SandroRat.yar" -include "./Mobile_Malware/Android_SlemBunk.yar" -include "./Mobile_Malware/Android_SpyAgent.yar" -include "./Mobile_Malware/Android_SpyNote.yar" -include "./Mobile_Malware/Android_Spynet.yar" -include "./Mobile_Malware/Android_Spywaller.yar" -include "./Mobile_Malware/Android_Switcher.yar" -include "./Mobile_Malware/Android_Tachi.yar" -include "./Mobile_Malware/Android_Tempting_Cedar_Spyware.yar" -include "./Mobile_Malware/Android_Tordow.yar" -include "./Mobile_Malware/Android_Triada_Banking.yar" -include "./Mobile_Malware/Android_Trojan_Dendroid.yar" -include "./Mobile_Malware/Android_Trojan_Droidjack.yar" -include "./Mobile_Malware/Android_VikingOrder.yar" -include "./Mobile_Malware/Android_VirusPolicia.yar" -include "./Mobile_Malware/Android_adware.yar" -include "./Mobile_Malware/Android_generic_adware.yar" -include "./Mobile_Malware/Android_generic_smsfraud.yar" -include "./Mobile_Malware/Android_malware_Advertising.yar" -include "./Mobile_Malware/Android_malware_ChinesePorn.yar" -include "./Mobile_Malware/Android_malware_Dropper.yar" -include "./Mobile_Malware/Android_malware_Fake_MosKow.yar" -include "./Mobile_Malware/Android_malware_HackingTeam.yar" -include "./Mobile_Malware/Android_malware_SMSsender.yar" -include "./Mobile_Malware/Android_malware_banker.yar" -include "./Mobile_Malware/Android_malware_xbot007.yar" -include "./Mobile_Malware/Android_mapin.yar" -include "./Mobile_Malware/Android_pornClicker.yar" -include "./Mobile_Malware/Android_sk_bankTr.yar" -include "./Packers/JJencode.yar" -include "./Packers/Javascript_exploit_and_obfuscation.yar" -include "./Packers/packer.yar" -include "./Packers/packer_compiler_signatures.yar" -include "./Packers/peid.yar" -include "./Webshells/WShell_APT_Laudanum.yar" -include "./Webshells/WShell_ASPXSpy.yar" -include "./Webshells/WShell_PHP_Anuna.yar" -include "./Webshells/WShell_PHP_in_images.yar" -include "./Webshells/WShell_THOR_Webshells.yar" -include "./Webshells/Wshell_ChineseSpam.yar" -include "./Webshells/Wshell_fire2013.yar" +include "./antidebug_antivm/antidebug_antivm.yar" +include "./capabilities/capabilities.yar" +include "./crypto/crypto_signatures.yar" +include "./cve_rules/CVE-2010-0805.yar" +include "./cve_rules/CVE-2010-0887.yar" +include "./cve_rules/CVE-2010-1297.yar" +include "./cve_rules/CVE-2012-0158.yar" +include "./cve_rules/CVE-2013-0074.yar" +include "./cve_rules/CVE-2013-0422.yar" +include "./cve_rules/CVE-2015-1701.yar" +include "./cve_rules/CVE-2015-2426.yar" +include "./cve_rules/CVE-2015-2545.yar" +include "./cve_rules/CVE-2015-5119.yar" +include "./cve_rules/CVE-2016-5195.yar" +include "./cve_rules/CVE-2017-11882.yar" +include "./cve_rules/CVE-2018-20250.yar" +include "./cve_rules/CVE-2018-4878.yar" include "./email/EMAIL_Cryptowall.yar" include "./email/attachment.yar" include "./email/bank_rule.yar" @@ -131,6 +26,36 @@ include "./email/email_Ukraine_BE_powerattack.yar" include "./email/image.yar" include "./email/scam.yar" include "./email/urls.yar" +include "./exploit_kits/EK_Angler.yar" +include "./exploit_kits/EK_Blackhole.yar" +include "./exploit_kits/EK_BleedingLife.yar" +include "./exploit_kits/EK_Crimepack.yar" +include "./exploit_kits/EK_Eleonore.yar" +include "./exploit_kits/EK_Fragus.yar" +include "./exploit_kits/EK_Phoenix.yar" +include "./exploit_kits/EK_Sakura.yar" +include "./exploit_kits/EK_ZeroAcces.yar" +include "./exploit_kits/EK_Zerox88.yar" +include "./exploit_kits/EK_Zeus.yar" +include "./maldocs/Maldoc_APT10_MenuPass.yar" +include "./maldocs/Maldoc_APT19_CVE-2017-1099.yar" +include "./maldocs/Maldoc_APT_OLE_JSRat.yar" +include "./maldocs/Maldoc_CVE-2017-0199.yar" +include "./maldocs/Maldoc_CVE_2017_11882.yar" +include "./maldocs/Maldoc_CVE_2017_8759.yar" +include "./maldocs/Maldoc_Contains_VBE_File.yar" +include "./maldocs/Maldoc_DDE.yar" +include "./maldocs/Maldoc_Dridex.yar" +include "./maldocs/Maldoc_Hidden_PE_file.yar" +include "./maldocs/Maldoc_MIME_ActiveMime_b64.yar" +include "./maldocs/Maldoc_PDF.yar" +include "./maldocs/Maldoc_PowerPointMouse.yar" +include "./maldocs/Maldoc_Suspicious_OLE_target.yar" +include "./maldocs/Maldoc_UserForm.yar" +include "./maldocs/Maldoc_VBA_macro_code.yar" +include "./maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar" +include "./maldocs/Maldoc_malrtf_ole2link.yar" +include "./maldocs/maldoc_somerules.yar" include "./malware/000_common_rules.yar" include "./malware/APT_APT1.yar" include "./malware/APT_APT10.yar" @@ -267,6 +192,7 @@ include "./malware/MALW_Exploit_UAC_Elevators.yar" include "./malware/MALW_Ezcob.yar" include "./malware/MALW_F0xy.yar" include "./malware/MALW_FALLCHILL.yar" +include "./malware/MALW_FUDCrypt.yar" include "./malware/MALW_FakeM.yar" include "./malware/MALW_Fareit.yar" include "./malware/MALW_Favorite.yar" @@ -303,6 +229,7 @@ include "./malware/MALW_LinuxMoose.yar" include "./malware/MALW_LostDoor.yar" include "./malware/MALW_LuaBot.yar" include "./malware/MALW_LuckyCat.yar" +include "./malware/MALW_MSILStealer.yar" include "./malware/MALW_MacControl.yar" include "./malware/MALW_Madness.yar" include "./malware/MALW_Magento_backend.yar" @@ -453,6 +380,7 @@ include "./malware/RANSOM_GPGQwerty.yar" include "./malware/RANSOM_GoldenEye.yar" include "./malware/RANSOM_Locky.yar" include "./malware/RANSOM_MS17-010_Wannacrypt.yar" +include "./malware/RANSOM_Maze.yar" include "./malware/RANSOM_PetrWrap.yar" include "./malware/RANSOM_Petya.yar" include "./malware/RANSOM_SamSam.yar" @@ -506,3 +434,16 @@ include "./malware/TOOLKIT_Pwdump.yar" include "./malware/TOOLKIT_THOR_HackTools.yar" include "./malware/TOOLKIT_Wineggdrop.yar" include "./malware/TOOLKIT_exe2hex_payload.yar" +include "./packers/JJencode.yar" +include "./packers/Javascript_exploit_and_obfuscation.yar" +include "./packers/packer.yar" +include "./packers/packer_compiler_signatures.yar" +include "./packers/peid.yar" +include "./webshells/WShell_APT_Laudanum.yar" +include "./webshells/WShell_ASPXSpy.yar" +include "./webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_PHP_Anuna.yar" +include "./webshells/WShell_PHP_in_images.yar" +include "./webshells/WShell_THOR_Webshells.yar" +include "./webshells/Wshell_ChineseSpam.yar" +include "./webshells/Wshell_fire2013.yar" diff --git a/Malicious_Documents/Maldoc_APT10_MenuPass.yar b/maldocs/Maldoc_APT10_MenuPass.yar similarity index 100% rename from Malicious_Documents/Maldoc_APT10_MenuPass.yar rename to maldocs/Maldoc_APT10_MenuPass.yar diff --git a/Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar b/maldocs/Maldoc_APT19_CVE-2017-1099.yar similarity index 100% rename from Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar rename to maldocs/Maldoc_APT19_CVE-2017-1099.yar diff --git a/Malicious_Documents/Maldoc_APT_OLE_JSRat.yar b/maldocs/Maldoc_APT_OLE_JSRat.yar similarity index 100% rename from Malicious_Documents/Maldoc_APT_OLE_JSRat.yar rename to maldocs/Maldoc_APT_OLE_JSRat.yar diff --git a/Malicious_Documents/Maldoc_CVE-2017-0199.yar b/maldocs/Maldoc_CVE-2017-0199.yar similarity index 100% rename from Malicious_Documents/Maldoc_CVE-2017-0199.yar rename to maldocs/Maldoc_CVE-2017-0199.yar diff --git a/Malicious_Documents/Maldoc_CVE_2017_11882.yar b/maldocs/Maldoc_CVE_2017_11882.yar similarity index 100% rename from Malicious_Documents/Maldoc_CVE_2017_11882.yar rename to maldocs/Maldoc_CVE_2017_11882.yar diff --git a/Malicious_Documents/Maldoc_CVE_2017_8759.yar b/maldocs/Maldoc_CVE_2017_8759.yar similarity index 100% rename from Malicious_Documents/Maldoc_CVE_2017_8759.yar rename to maldocs/Maldoc_CVE_2017_8759.yar diff --git a/Malicious_Documents/Maldoc_Contains_VBE_File.yar b/maldocs/Maldoc_Contains_VBE_File.yar similarity index 100% rename from Malicious_Documents/Maldoc_Contains_VBE_File.yar rename to maldocs/Maldoc_Contains_VBE_File.yar diff --git a/Malicious_Documents/Maldoc_DDE.yar b/maldocs/Maldoc_DDE.yar similarity index 100% rename from Malicious_Documents/Maldoc_DDE.yar rename to maldocs/Maldoc_DDE.yar diff --git a/Malicious_Documents/Maldoc_Dridex.yar b/maldocs/Maldoc_Dridex.yar similarity index 100% rename from Malicious_Documents/Maldoc_Dridex.yar rename to maldocs/Maldoc_Dridex.yar diff --git a/Malicious_Documents/Maldoc_Hidden_PE_file.yar b/maldocs/Maldoc_Hidden_PE_file.yar similarity index 100% rename from Malicious_Documents/Maldoc_Hidden_PE_file.yar rename to maldocs/Maldoc_Hidden_PE_file.yar diff --git a/Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar b/maldocs/Maldoc_MIME_ActiveMime_b64.yar similarity index 100% rename from Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar rename to maldocs/Maldoc_MIME_ActiveMime_b64.yar diff --git a/Malicious_Documents/Maldoc_PDF.yar b/maldocs/Maldoc_PDF.yar similarity index 100% rename from Malicious_Documents/Maldoc_PDF.yar rename to maldocs/Maldoc_PDF.yar diff --git a/Malicious_Documents/Maldoc_PowerPointMouse.yar b/maldocs/Maldoc_PowerPointMouse.yar similarity index 100% rename from Malicious_Documents/Maldoc_PowerPointMouse.yar rename to maldocs/Maldoc_PowerPointMouse.yar diff --git a/Malicious_Documents/Maldoc_Suspicious_OLE_target.yar b/maldocs/Maldoc_Suspicious_OLE_target.yar similarity index 100% rename from Malicious_Documents/Maldoc_Suspicious_OLE_target.yar rename to maldocs/Maldoc_Suspicious_OLE_target.yar diff --git a/Malicious_Documents/Maldoc_UserForm.yar b/maldocs/Maldoc_UserForm.yar similarity index 100% rename from Malicious_Documents/Maldoc_UserForm.yar rename to maldocs/Maldoc_UserForm.yar diff --git a/Malicious_Documents/Maldoc_VBA_macro_code.yar b/maldocs/Maldoc_VBA_macro_code.yar similarity index 100% rename from Malicious_Documents/Maldoc_VBA_macro_code.yar rename to maldocs/Maldoc_VBA_macro_code.yar diff --git a/Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar b/maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar similarity index 100% rename from Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar rename to maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar diff --git a/Malicious_Documents/Maldoc_hancitor_dropper b/maldocs/Maldoc_hancitor_dropper similarity index 100% rename from Malicious_Documents/Maldoc_hancitor_dropper rename to maldocs/Maldoc_hancitor_dropper diff --git a/Malicious_Documents/Maldoc_malrtf_ole2link.yar b/maldocs/Maldoc_malrtf_ole2link.yar similarity index 100% rename from Malicious_Documents/Maldoc_malrtf_ole2link.yar rename to maldocs/Maldoc_malrtf_ole2link.yar diff --git a/Malicious_Documents/maldoc_somerules.yar b/maldocs/maldoc_somerules.yar similarity index 100% rename from Malicious_Documents/maldoc_somerules.yar rename to maldocs/maldoc_somerules.yar diff --git a/maldocs_index.yar b/maldocs_index.yar new file mode 100644 index 0000000..8c1b096 --- /dev/null +++ b/maldocs_index.yar @@ -0,0 +1,23 @@ +/* +Generated by Yara-Rules +On 08-01-2020 +*/ +include "./maldocs/Maldoc_APT10_MenuPass.yar" +include "./maldocs/Maldoc_APT19_CVE-2017-1099.yar" +include "./maldocs/Maldoc_APT_OLE_JSRat.yar" +include "./maldocs/Maldoc_CVE-2017-0199.yar" +include "./maldocs/Maldoc_CVE_2017_11882.yar" +include "./maldocs/Maldoc_CVE_2017_8759.yar" +include "./maldocs/Maldoc_Contains_VBE_File.yar" +include "./maldocs/Maldoc_DDE.yar" +include "./maldocs/Maldoc_Dridex.yar" +include "./maldocs/Maldoc_Hidden_PE_file.yar" +include "./maldocs/Maldoc_MIME_ActiveMime_b64.yar" +include "./maldocs/Maldoc_PDF.yar" +include "./maldocs/Maldoc_PowerPointMouse.yar" +include "./maldocs/Maldoc_Suspicious_OLE_target.yar" +include "./maldocs/Maldoc_UserForm.yar" +include "./maldocs/Maldoc_VBA_macro_code.yar" +include "./maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar" +include "./maldocs/Maldoc_malrtf_ole2link.yar" +include "./maldocs/maldoc_somerules.yar" diff --git a/malware_index.yar b/malware_index.yar index fe7ce99..5ddcc03 100644 --- a/malware_index.yar +++ b/malware_index.yar @@ -1,6 +1,6 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ include "./malware/000_common_rules.yar" include "./malware/APT_APT1.yar" @@ -138,6 +138,7 @@ include "./malware/MALW_Exploit_UAC_Elevators.yar" include "./malware/MALW_Ezcob.yar" include "./malware/MALW_F0xy.yar" include "./malware/MALW_FALLCHILL.yar" +include "./malware/MALW_FUDCrypt.yar" include "./malware/MALW_FakeM.yar" include "./malware/MALW_Fareit.yar" include "./malware/MALW_Favorite.yar" @@ -174,6 +175,7 @@ include "./malware/MALW_LinuxMoose.yar" include "./malware/MALW_LostDoor.yar" include "./malware/MALW_LuaBot.yar" include "./malware/MALW_LuckyCat.yar" +include "./malware/MALW_MSILStealer.yar" include "./malware/MALW_MacControl.yar" include "./malware/MALW_Madness.yar" include "./malware/MALW_Magento_backend.yar" @@ -324,6 +326,7 @@ include "./malware/RANSOM_GPGQwerty.yar" include "./malware/RANSOM_GoldenEye.yar" include "./malware/RANSOM_Locky.yar" include "./malware/RANSOM_MS17-010_Wannacrypt.yar" +include "./malware/RANSOM_Maze.yar" include "./malware/RANSOM_PetrWrap.yar" include "./malware/RANSOM_Petya.yar" include "./malware/RANSOM_SamSam.yar"