20 lines
417 B
Text
20 lines
417 B
Text
|
rule dropper
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Detects a dropper"
|
||
|
|
author = "vitorafonso"
|
||
|
|
samples = "4144f5cf8d8b3e228ad428a6e3bf6547132171609893df46f342d6716854f329, e1afcf6670d000f86b9aea4abcec7f38b7e6294b4d683c04f0b4f7083b6b311e"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = "splitPayLoadFromDex"
|
||
|
|
$b = "readDexFileFromApk"
|
||
|
|
$c = "payload_odex"
|
||
|
|
$d = "payload_libs"
|
||
|
|
$e = "/payload.apk"
|
||
|
|
$f = "makeApplication"
|
||
|
|
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
|
||
|
|
}
|