YARA unknown stable yara

android_mazarBot_z [Android]

Yara detection for MazarBOT

View Source

Detection Logic

androguard.certificate.sha1("50FD99C06C2EE360296DCDA9896AD93CAE32266B") or
		
		(androguard.package_name("com.mazar") and
		androguard.activity(/\.DevAdminDisabler/) and 
		androguard.receiver(/\.DevAdminReceiver/) and 
		androguard.service(/\.WorkerService/i)) or 
		
		androguard.permission(/android.permission.INTERNET/) and
		androguard.permission(/android.permission.SEND_SMS/) and
		androguard.permission(/android.permission.CALL_PHONE/) and
		all of ($str_*)

Field Validations

Loading…

Comments (0)

Loading comments...