mirror of
https://github.com/Yara-Rules/rules
synced 2026-06-08 12:58:40 +00:00
mmorenog
18 lines
322 B
Plaintext
18 lines
322 B
Plaintext
rule MALW_FakePyPI
|
|
{
|
|
meta:
|
|
description = "Identifies fake PyPI Packages."
|
|
author = "@bartblaze"
|
|
reference = "http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/"
|
|
date = "2017-09"
|
|
tlp = "white"
|
|
|
|
strings:
|
|
$ = "# Welcome Here! :)"
|
|
$ = "# just toy, no harm :)"
|
|
$ = "[0x76,0x21,0xfe,0xcc,0xee]"
|
|
|
|
condition:
|
|
all of them
|
|
}
|