mirror of
https://github.com/Yara-Rules/rules
synced 2026-06-08 12:58:40 +00:00
Jaume Martin
62 lines
1.4 KiB
Plaintext
62 lines
1.4 KiB
Plaintext
rule marcher1
|
|
{
|
|
meta:
|
|
author = "Antonio S. <asanchez@koodous.com>"
|
|
source = "https://analyst.koodous.com/rulesets/890"
|
|
description = "This rule detects is to detect a type of banking malware"
|
|
sample = "33b1a9e4a1591c1a39fdd5295874e365dbde9448098254a938525385498da070"
|
|
|
|
strings:
|
|
$a = "cmVudCYmJg=="
|
|
$b = "dXNzZCYmJg=="
|
|
|
|
condition:
|
|
all of them
|
|
|
|
}
|
|
|
|
rule marcher2
|
|
{
|
|
meta:
|
|
author = "Antonio S. <asanchez@koodous.com>"
|
|
source = "https://analyst.koodous.com/rulesets/890"
|
|
strings:
|
|
$a = "HDNRQ2gOlm"
|
|
$b = "lElvyohc9Y1X+nzVUEjW8W3SbUA"
|
|
condition:
|
|
all of them
|
|
|
|
}
|
|
|
|
rule marcher3
|
|
{
|
|
meta:
|
|
author = "Antonio S. <asanchez@koodous.com>"
|
|
source = "https://analyst.koodous.com/rulesets/890"
|
|
sample1 = "087710b944c09c3905a5a9c94337a75ad88706587c10c632b78fad52ec8dfcbe"
|
|
sample2 = "fa7a9145b8fc32e3ac16fa4a4cf681b2fa5405fc154327f879eaf71dd42595c2"
|
|
strings:
|
|
$a = "certificado # 73828394"
|
|
$b = "A compania TMN informa que o vosso sistema Android tem vulnerabilidade"
|
|
|
|
condition:
|
|
all of them
|
|
}
|
|
|
|
rule marcher_v2
|
|
{
|
|
meta:
|
|
description = "This rule detects a new variant of Marcher"
|
|
sample = "27c3b0aaa2be02b4ee2bfb5b26b2b90dbefa020b9accc360232e0288ac34767f"
|
|
author = "Antonio S. <asanchez@koodous.com>"
|
|
source = "https://analyst.koodous.com/rulesets/1301"
|
|
strings:
|
|
$a = /assets\/[a-z]{1,12}.datPK/
|
|
$b = "mastercard_img"
|
|
$c = "visa_verifed"
|
|
|
|
condition:
|
|
all of them
|
|
|
|
}
|