16 lines
411 B
Text
16 lines
411 B
Text
|
rule android_tempting_cedar_spyware
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
Author = "@X0RC1SM"
|
||
|
|
Date = "2018-03-06"
|
||
|
|
Reference = "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware"
|
||
|
|
strings:
|
||
|
|
$PK_HEADER = {50 4B 03 04}
|
||
|
|
$MANIFEST = "META-INF/MANIFEST.MF"
|
||
|
|
$DEX_FILE = "classes.dex"
|
||
|
|
$string = "rsdroid.crt"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
$PK_HEADER in (0..4) and $MANIFEST and $DEX_FILE and any of ($string*)
|
||
|
|
}
|