mirror of
https://github.com/Yara-Rules/rules
synced 2026-06-08 12:58:40 +00:00
Jaume Martin
33 lines
1.3 KiB
Plaintext
33 lines
1.3 KiB
Plaintext
/*
|
|
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
|
|
|
|
*/
|
|
|
|
import "androguard"
|
|
|
|
|
|
rule spyAgent
|
|
{
|
|
meta:
|
|
description = "This rule detects arabian spyware which records call and gathers user information which is later sent to a remote c&c"
|
|
sample = "7cbf61fbb31c26530cafb46282f5c90bc10fe5c724442b8d1a0b87a8125204cb"
|
|
reference = "https://blogs.mcafee.com/mcafee-labs/android-spyware-targets-security-job-seekers-in-saudi-arabia/"
|
|
author = "@koodous_project"
|
|
|
|
strings:
|
|
$phone = "0597794205"
|
|
$caption = "New victim arrived"
|
|
$cc = "http://ksa-sef.com/Hack%20Mobaile/ADDNewSMS.php"
|
|
$cc_alt = "http://ksa-sef.com/Hack%20Mobaile/AddAllLogCall.php"
|
|
$cc_alt2= "http://ksa-sef.com/Hack%20Mobaile/addScreenShot.php"
|
|
$cc_alt3= "http://ksa-sef.com/Hack%20Mobaile/ADDSMS.php"
|
|
$cc_alt4 = "http://ksa-sef.com/Hack%20Mobaile/ADDVCF.php"
|
|
$cc_alt5 = "http://ksa-sef.com/Hack%20Mobaile/ADDIMSI.php"
|
|
$cc_alt6 = "http://ksa-sef.com/Hack%20Mobaile/ADDHISTORYINTERNET.php"
|
|
$cc_alt7 = "http://ksa-sef.com/Hack%20Mobaile/addInconingLogs.php"
|
|
|
|
condition:
|
|
androguard.url(/ksa-sef\.com/) or ($phone and $caption) or ($cc and $cc_alt and $cc_alt2 and $cc_alt3 and $cc_alt4 and $cc_alt5 and $cc_alt6 and $cc_alt7)
|
|
|
|
}
|