32 lines
845 B
Text
32 lines
845 B
Text
|
rule sakura_jar
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "Josh Berry"
|
||
|
|
date = "2016-06-26"
|
||
|
|
description = "Sakura Exploit Kit Detection"
|
||
|
|
hash0 = "a566ba2e3f260c90e01366e8b0d724eb"
|
||
|
|
sample_filetype = "unknown"
|
||
|
|
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
|
||
|
|
strings:
|
||
|
|
$string0 = "Rotok.classPK"
|
||
|
|
$string1 = "nnnolg"
|
||
|
|
$string2 = "X$Z'\\4^=aEbIdUmiprsxt}v<" wide
|
||
|
|
$string3 = "()Ljava/util/Set;"
|
||
|
|
$string4 = "(Ljava/lang/String;)V"
|
||
|
|
$string5 = "Ljava/lang/Exception;"
|
||
|
|
$string6 = "oooy32"
|
||
|
|
$string7 = "Too.java"
|
||
|
|
$string8 = "bbfwkd"
|
||
|
|
$string9 = "Ljava/lang/Process;"
|
||
|
|
$string10 = "getParameter"
|
||
|
|
$string11 = "length"
|
||
|
|
$string12 = "Simio.java"
|
||
|
|
$string13 = "Ljavax/swing/JList;"
|
||
|
|
$string14 = "-(Ljava/lang/String;)Ljava/lang/StringBuilder;"
|
||
|
|
$string15 = "Ljava/io/InputStream;"
|
||
|
|
$string16 = "vfnnnrof.exnnnroe"
|
||
|
|
$string17 = "Olsnnfw"
|
||
|
|
condition:
|
||
|
|
17 of them
|
||
|
|
}
|