Sneed-Reactivity/yara-mikesxrs/codewatchorg/sakura_jar.yar
Sam Sneed 08e8d462fe OMG ISTG PLS WORK
RED PILL 🔴 💊
2024-07-25 12:43:35 -05:00

31 lines
845 B
Text

rule sakura_jar
{
meta:
author = "Josh Berry"
date = "2016-06-26"
description = "Sakura Exploit Kit Detection"
hash0 = "a566ba2e3f260c90e01366e8b0d724eb"
sample_filetype = "unknown"
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
$string0 = "Rotok.classPK"
$string1 = "nnnolg"
$string2 = "X$Z'\\4^=aEbIdUmiprsxt}v<" wide
$string3 = "()Ljava/util/Set;"
$string4 = "(Ljava/lang/String;)V"
$string5 = "Ljava/lang/Exception;"
$string6 = "oooy32"
$string7 = "Too.java"
$string8 = "bbfwkd"
$string9 = "Ljava/lang/Process;"
$string10 = "getParameter"
$string11 = "length"
$string12 = "Simio.java"
$string13 = "Ljavax/swing/JList;"
$string14 = "-(Ljava/lang/String;)Ljava/lang/StringBuilder;"
$string15 = "Ljava/io/InputStream;"
$string16 = "vfnnnrof.exnnnroe"
$string17 = "Olsnnfw"
condition:
17 of them
}