YARA unknown stable yara

andr_sk_bank [Android]

Yara rule for Banking trojan targeting South Korean banks

View Source

Detection Logic

androguard.package_name("com.qbjkyd.rhsxa") or
		androguard.certificate.sha1("543382EDDAFC05B435F13BBE97037BB335C2948B") or
		(androguard.permission(/android.permission.RECEIVE_SMS/) and
		androguard.permission(/android.permission.INTERNET/) and 
		androguard.permission(/android.permission.RECEIVE_BOOT_COMPLETED/) and 
		all of ($str_*))

Field Validations

Loading…

Comments (0)

Loading comments...