YARA unknown stable yara

android_spywaller [Android]

Rule for detection of Android Spywaller samples

View Source

Detection Logic

androguard.certificate.sha1("165F84B05BD33DA1BA0A8E027CEF6026B7005978") or
		androguard.permission(/android.permission.INTERNET/) and
		androguard.permission(/android.permission.READ_PHONE_STATE/) and 
		all of ($str_*)

Field Validations

Loading…

Comments (0)

Loading comments...