mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
12 lines
783 B
Plaintext
12 lines
783 B
Plaintext
|
|
rule HackTool_AndroidOS_Metasploit_E_MTB{
|
|
meta:
|
|
description = "HackTool:AndroidOS/Metasploit.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {1a 00 08 0e 71 10 c0 21 00 00 0c 00 1a 01 b7 0f 12 02 23 22 61 06 6e 30 ca 21 10 02 0c 01 12 00 12 02 6e 30 7c 22 01 02 0c 00 1f 00 18 00 39 00 14 00 22 00 6f 00 71 00 7c 01 00 00 0c 02 70 20 6b 01 20 00 22 02 cb 01 70 20 e5 0a 12 00 6e 20 71 01 20 00 0e 00 } //1
|
|
$a_01_1 = {b7 21 59 01 44 05 54 30 28 04 54 31 28 04 52 11 44 05 54 32 28 04 52 22 7d 05 b7 21 59 01 7d 05 54 30 28 04 54 31 28 04 52 11 be 05 54 32 28 04 52 22 7d 05 b6 21 59 01 7d 05 54 30 28 04 54 31 28 04 52 11 12 05 54 32 28 04 52 22 62 05 b6 21 59 01 62 05 } //1
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2
|
|
|
|
} |