diff --git a/.travis.yml b/.travis.yml index 8be5bd48..988a23a6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,32 +1,30 @@ language: c sudo: required -#dist: trusty + before_install: - sudo apt-get -qq update - - sudo apt-get install jq + - sudo apt-get install -y \ + automake \ + libtool \ + make \ + gcc \ + pkg-config \ + flex \ + bison \ + libjansson-dev \ + libmagic-dev \ + libssl-dev \ + jq # Yara - wget $(curl -s https://api.github.com/repos/VirusTotal/yara/releases/latest | jq -r ".tarball_url") -O yara.tar.gz - #- wget $(wget -O - https://api.github.com/repos/VirusTotal/yara/releases/9250110 | jq -r ".tarball_url") -O yara.tar.gz - mkdir yara - tar -C yara -xzvf yara.tar.gz --strip-components 1 -# Androguard for Yara - - wget https://raw.githubusercontent.com/Koodous/androguard-yara/master/androguard.c -O yara/libyara/modules/androguard.c - - wget https://raw.githubusercontent.com/Koodous/androguard-yara/master/dist/yara-3.7.0/libyara/modules/module_list -O yara/libyara/modules/module_list - - wget https://raw.githubusercontent.com/Koodous/androguard-yara/master/dist/yara-3.7.0/libyara/Makefile.am -O yara/libyara/Makefile.am -# libjansson - - wget http://www.digip.org/jansson/releases/jansson-2.7.tar.gz - - tar -xzvf jansson-2.7.tar.gz - - cd jansson-2.7 - - ./configure - - make - - sudo make install - # Compile Yara - cd ../yara # Update per issue 176 - - sed -i 's/#define RE_MAX_SPLIT_ID 128/#define RE_MAX_SPLIT_ID 255/g' libyara/re.c + - sed -i 's/#define RE_MAX_SPLIT_ID 128/#define RE_MAX_SPLIT_ID 255/g' libyara/include/yara/limits.h - ./bootstrap.sh - - ./configure --enable-cuckoo + - ./configure --enable-cuckoo --enable-magic --with-crypto - make - sudo make install - sudo ldconfig @@ -34,8 +32,6 @@ before_install: script: - echo "test" > testfile - - echo "{}" > androguard_report.json - FALLO=0 -# - for j in $(ls -d */); do for i in $(find $j -type f -name "*.yara" ; find $j -type f -name "*.yar"); do echo $i; yara -x androguard=androguard_report.json $i testfile; if [[ $? -ne 0 ]]; then FALLO=1; fi; done; done - - for i in $(ls *_index.yar); do echo $i; yara -w -x androguard=androguard_report.json $i testfile; if [[ $? -ne 0 ]]; then FALLO=1; fi; done + - for i in $(ls *_index.yar); do echo $i; yara -w $i testfile; if [[ $? -ne 0 ]]; then FALLO=1; fi; done - exit $FALLO diff --git a/Antidebug_AntiVM_index.yar b/Antidebug_AntiVM_index.yar index 6e0e9829..f63e1f5c 100644 --- a/Antidebug_AntiVM_index.yar +++ b/Antidebug_AntiVM_index.yar @@ -1,5 +1,5 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Antidebug_AntiVM/antidebug_antivm.yar" +include "./antidebug_antivm/antidebug_antivm.yar" diff --git a/CVE_Rules_index.yar b/CVE_Rules_index.yar index df2298f5..cfc08376 100644 --- a/CVE_Rules_index.yar +++ b/CVE_Rules_index.yar @@ -1,18 +1,18 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./CVE_Rules/CVE-2010-0805.yar" -include "./CVE_Rules/CVE-2010-0887.yar" -include "./CVE_Rules/CVE-2010-1297.yar" -include "./CVE_Rules/CVE-2012-0158.yar" -include "./CVE_Rules/CVE-2013-0074.yar" -include "./CVE_Rules/CVE-2013-0422.yar" -include "./CVE_Rules/CVE-2015-1701.yar" -include "./CVE_Rules/CVE-2015-2426.yar" -include "./CVE_Rules/CVE-2015-2545.yar" -include "./CVE_Rules/CVE-2015-5119.yar" -include "./CVE_Rules/CVE-2016-5195.yar" -include "./CVE_Rules/CVE-2017-11882.yar" -include "./CVE_Rules/CVE-2018-20250.yar" -include "./CVE_Rules/CVE-2018-4878.yar" +include "./cve_rules/CVE-2010-0805.yar" +include "./cve_rules/CVE-2010-0887.yar" +include "./cve_rules/CVE-2010-1297.yar" +include "./cve_rules/CVE-2012-0158.yar" +include "./cve_rules/CVE-2013-0074.yar" +include "./cve_rules/CVE-2013-0422.yar" +include "./cve_rules/CVE-2015-1701.yar" +include "./cve_rules/CVE-2015-2426.yar" +include "./cve_rules/CVE-2015-2545.yar" +include "./cve_rules/CVE-2015-5119.yar" +include "./cve_rules/CVE-2016-5195.yar" +include "./cve_rules/CVE-2017-11882.yar" +include "./cve_rules/CVE-2018-20250.yar" +include "./cve_rules/CVE-2018-4878.yar" diff --git a/Capabilities_index.yar b/Capabilities_index.yar index 42a7f694..5cbc3025 100644 --- a/Capabilities_index.yar +++ b/Capabilities_index.yar @@ -1,5 +1,5 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Capabilities/capabilities.yar" +include "./capabilities/capabilities.yar" diff --git a/Crypto_index.yar b/Crypto_index.yar index 7f6d67e8..07a71f64 100644 --- a/Crypto_index.yar +++ b/Crypto_index.yar @@ -1,5 +1,5 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Crypto/crypto_signatures.yar" +include "./crypto/crypto_signatures.yar" diff --git a/Exploit-Kits_index.yar b/Exploit-Kits_index.yar deleted file mode 100644 index 3b292b33..00000000 --- a/Exploit-Kits_index.yar +++ /dev/null @@ -1,15 +0,0 @@ -/* -Generated by Yara-Rules -On 26-11-2019 -*/ -include "./Exploit-Kits/EK_Angler.yar" -include "./Exploit-Kits/EK_Blackhole.yar" -include "./Exploit-Kits/EK_BleedingLife.yar" -include "./Exploit-Kits/EK_Crimepack.yar" -include "./Exploit-Kits/EK_Eleonore.yar" -include "./Exploit-Kits/EK_Fragus.yar" -include "./Exploit-Kits/EK_Phoenix.yar" -include "./Exploit-Kits/EK_Sakura.yar" -include "./Exploit-Kits/EK_ZeroAcces.yar" -include "./Exploit-Kits/EK_Zerox88.yar" -include "./Exploit-Kits/EK_Zeus.yar" diff --git a/Malicious_Documents_index.yar b/Malicious_Documents_index.yar deleted file mode 100644 index 8e633ec7..00000000 --- a/Malicious_Documents_index.yar +++ /dev/null @@ -1,23 +0,0 @@ -/* -Generated by Yara-Rules -On 26-11-2019 -*/ -include "./Malicious_Documents/Maldoc_APT10_MenuPass.yar" -include "./Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar" -include "./Malicious_Documents/Maldoc_APT_OLE_JSRat.yar" -include "./Malicious_Documents/Maldoc_CVE-2017-0199.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_11882.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_8759.yar" -include "./Malicious_Documents/Maldoc_Contains_VBE_File.yar" -include "./Malicious_Documents/Maldoc_DDE.yar" -include "./Malicious_Documents/Maldoc_Dridex.yar" -include "./Malicious_Documents/Maldoc_Hidden_PE_file.yar" -include "./Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar" -include "./Malicious_Documents/Maldoc_PDF.yar" -include "./Malicious_Documents/Maldoc_PowerPointMouse.yar" -include "./Malicious_Documents/Maldoc_Suspicious_OLE_target.yar" -include "./Malicious_Documents/Maldoc_UserForm.yar" -include "./Malicious_Documents/Maldoc_VBA_macro_code.yar" -include "./Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar" -include "./Malicious_Documents/Maldoc_malrtf_ole2link.yar" -include "./Malicious_Documents/maldoc_somerules.yar" diff --git a/Mobile_Malware_index.yar b/Mobile_Malware_index.yar index 3f9cf755..46ff07ca 100644 --- a/Mobile_Malware_index.yar +++ b/Mobile_Malware_index.yar @@ -1,67 +1,4 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Mobile_Malware/Android_ASSDdeveloper.yar" -include "./Mobile_Malware/Android_AVITOMMS.yar" -include "./Mobile_Malware/Android_AliPay_smsStealer.yar" -include "./Mobile_Malware/Android_Amtrckr_20160519.yar" -include "./Mobile_Malware/Android_Backdoor.yar" -include "./Mobile_Malware/Android_Backdoor_script.yar" -include "./Mobile_Malware/Android_BadMirror.yar" -include "./Mobile_Malware/Android_Banker_Acecard.yar" -include "./Mobile_Malware/Android_BatteryBot_ClickFraud.yar" -include "./Mobile_Malware/Android_Clicker_G.yar" -include "./Mobile_Malware/Android_Copy9.yar" -include "./Mobile_Malware/Android_DeathRing.yar" -include "./Mobile_Malware/Android_Dectus_rswm.yar" -include "./Mobile_Malware/Android_Dendroid_RAT.yar" -include "./Mobile_Malware/Android_Dogspectus.yar" -include "./Mobile_Malware/Android_FakeApps.yar" -include "./Mobile_Malware/Android_FakeBank_Fanta.yar" -include "./Mobile_Malware/Android_Godless.yar" -include "./Mobile_Malware/Android_HackintTeam_Implant.yar" -include "./Mobile_Malware/Android_Libyan_Scorpions.yar" -include "./Mobile_Malware/Android_MalwareCertificates.yar" -include "./Mobile_Malware/Android_Malware_Ramsonware.yar" -include "./Mobile_Malware/Android_Malware_Tinhvan.yar" -include "./Mobile_Malware/Android_Malware_Towelroot.yar" -include "./Mobile_Malware/Android_Marcher_2.yar" -include "./Mobile_Malware/Android_MazarBot_z.yar" -include "./Mobile_Malware/Android_Metasploit.yar" -include "./Mobile_Malware/Android_Metasploit_Payload.yar" -include "./Mobile_Malware/Android_OmniRat.yar" -include "./Mobile_Malware/Android_Overlayer.yar" -include "./Mobile_Malware/Android_Pink_Locker.yar" -include "./Mobile_Malware/Android_Polish_Bankbot.yar" -include "./Mobile_Malware/Android_RuMMS.yar" -include "./Mobile_Malware/Android_SMSFraud.yar" -include "./Mobile_Malware/Android_SandroRat.yar" -include "./Mobile_Malware/Android_SlemBunk.yar" -include "./Mobile_Malware/Android_SpyAgent.yar" -include "./Mobile_Malware/Android_SpyNote.yar" -include "./Mobile_Malware/Android_Spynet.yar" -include "./Mobile_Malware/Android_Spywaller.yar" -include "./Mobile_Malware/Android_Switcher.yar" -include "./Mobile_Malware/Android_Tachi.yar" -include "./Mobile_Malware/Android_Tempting_Cedar_Spyware.yar" -include "./Mobile_Malware/Android_Tordow.yar" -include "./Mobile_Malware/Android_Triada_Banking.yar" -include "./Mobile_Malware/Android_Trojan_Dendroid.yar" -include "./Mobile_Malware/Android_Trojan_Droidjack.yar" -include "./Mobile_Malware/Android_VikingOrder.yar" -include "./Mobile_Malware/Android_VirusPolicia.yar" -include "./Mobile_Malware/Android_adware.yar" -include "./Mobile_Malware/Android_generic_adware.yar" -include "./Mobile_Malware/Android_generic_smsfraud.yar" -include "./Mobile_Malware/Android_malware_Advertising.yar" -include "./Mobile_Malware/Android_malware_ChinesePorn.yar" -include "./Mobile_Malware/Android_malware_Dropper.yar" -include "./Mobile_Malware/Android_malware_Fake_MosKow.yar" -include "./Mobile_Malware/Android_malware_HackingTeam.yar" -include "./Mobile_Malware/Android_malware_SMSsender.yar" -include "./Mobile_Malware/Android_malware_banker.yar" -include "./Mobile_Malware/Android_malware_xbot007.yar" -include "./Mobile_Malware/Android_mapin.yar" -include "./Mobile_Malware/Android_pornClicker.yar" -include "./Mobile_Malware/Android_sk_bankTr.yar" diff --git a/Packers_index.yar b/Packers_index.yar index f7d3e992..8f349ba1 100644 --- a/Packers_index.yar +++ b/Packers_index.yar @@ -1,9 +1,9 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Packers/JJencode.yar" -include "./Packers/Javascript_exploit_and_obfuscation.yar" -include "./Packers/packer.yar" -include "./Packers/packer_compiler_signatures.yar" -include "./Packers/peid.yar" +include "./packers/JJencode.yar" +include "./packers/Javascript_exploit_and_obfuscation.yar" +include "./packers/packer.yar" +include "./packers/packer_compiler_signatures.yar" +include "./packers/peid.yar" diff --git a/README.md b/README.md index 986d85f6..e93adb1f 100644 --- a/README.md +++ b/README.md @@ -14,8 +14,6 @@ If you’re interested in sharing your Yara rules with us and the Security Commu Twitter account: https://twitter.com/yararules -Mailing list : http://list.yararules.com/mailman/listinfo/yararules.com.signatures - # Requirements Yara **version 3.0** or higher is required for most of our rules to work. This is mainly due to the use of the "pe" module introduced in that version. @@ -24,7 +22,9 @@ You can check your installed version with `yara -v` Packages available in Ubuntu 14.04 LTS default repositories are too old. You can alternatively install from source or use the packages available in the [Remnux repository](https://launchpad.net/~remnux/+archive/ubuntu/stable). -Also, you will need [Androguard Module](https://github.com/Koodous/androguard-yara) if you want to use the rules in the 'mobile_malware' category. +~~Also, you will need [Androguard Module](https://github.com/Koodous/androguard-yara) if you want to use the rules in the 'mobile_malware' category.~~ + +We have deprecated mobile_malware rules that depend on Androguard Module because it seems an abandoned project. # Categories @@ -36,7 +36,7 @@ In this section you will find Yara Rules aimed toward the detection of anti-debu In this section you will find Yara rules to detect capabilities that do not fit into any of the other categories. They are useful to know for analysis but may not be malicious indicators on their own. -## CVE_Rules +## CVE Rules In this section you will find Yara Rules specialised toward the identification of specific Common Vulnerabilities and Exposures (CVEs) @@ -72,9 +72,9 @@ In this section you will find Yara rules specialised toward the identification o In this section you will find Yara rules specialised toward the identification of well-known mobile malware. -Many rules in this section use the Androguard module developed by the people over at https://koodous.com/. +## Deprecated -You can get it, along with installation instructions, at https://github.com/Koodous/androguard-yara +In this section you will find Yara rules deprecated. # Contact @@ -82,4 +82,3 @@ Webpage: http://yararules.com Twitter account: https://twitter.com/yararules -Mail list : http://list.yararules.com/mailman/listinfo/yararules.com.signatures diff --git a/Webshells_index.yar b/Webshells_index.yar index 10427de5..43bd69d3 100644 --- a/Webshells_index.yar +++ b/Webshells_index.yar @@ -1,12 +1,12 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Webshells/WShell_APT_Laudanum.yar" -include "./Webshells/WShell_ASPXSpy.yar" -include "./Webshells/WShell_PHP_Anuna.yar" -include "./Webshells/WShell_PHP_in_images.yar" -include "./Webshells/WShell_THOR_Webshells.yar" -include "./Webshells/Wshell_ChineseSpam.yar" -include "./Webshells/Wshell_fire2013.yar" -include "./Webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_APT_Laudanum.yar" +include "./webshells/WShell_ASPXSpy.yar" +include "./webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_PHP_Anuna.yar" +include "./webshells/WShell_PHP_in_images.yar" +include "./webshells/WShell_THOR_Webshells.yar" +include "./webshells/Wshell_ChineseSpam.yar" +include "./webshells/Wshell_fire2013.yar" diff --git a/Mobile_Malware/Android_ASSDdeveloper.yar b/deprecated/Android_ASSDdeveloper.yar similarity index 100% rename from Mobile_Malware/Android_ASSDdeveloper.yar rename to deprecated/Android_ASSDdeveloper.yar diff --git a/Mobile_Malware/Android_AVITOMMS.yar b/deprecated/Android_AVITOMMS.yar similarity index 100% rename from Mobile_Malware/Android_AVITOMMS.yar rename to deprecated/Android_AVITOMMS.yar diff --git a/Mobile_Malware/Android_AliPay_smsStealer.yar b/deprecated/Android_AliPay_smsStealer.yar similarity index 100% rename from Mobile_Malware/Android_AliPay_smsStealer.yar rename to deprecated/Android_AliPay_smsStealer.yar diff --git a/Mobile_Malware/Android_Amtrckr_20160519.yar b/deprecated/Android_Amtrckr_20160519.yar similarity index 100% rename from Mobile_Malware/Android_Amtrckr_20160519.yar rename to deprecated/Android_Amtrckr_20160519.yar diff --git a/Mobile_Malware/Android_Backdoor.yar b/deprecated/Android_Backdoor.yar similarity index 100% rename from Mobile_Malware/Android_Backdoor.yar rename to deprecated/Android_Backdoor.yar diff --git a/Mobile_Malware/Android_Backdoor_script.yar b/deprecated/Android_Backdoor_script.yar similarity index 100% rename from Mobile_Malware/Android_Backdoor_script.yar rename to deprecated/Android_Backdoor_script.yar diff --git a/Mobile_Malware/Android_BadMirror.yar b/deprecated/Android_BadMirror.yar similarity index 100% rename from Mobile_Malware/Android_BadMirror.yar rename to deprecated/Android_BadMirror.yar diff --git a/Mobile_Malware/Android_Banker_Acecard.yar b/deprecated/Android_Banker_Acecard.yar similarity index 100% rename from Mobile_Malware/Android_Banker_Acecard.yar rename to deprecated/Android_Banker_Acecard.yar diff --git a/Mobile_Malware/Android_BatteryBot_ClickFraud.yar b/deprecated/Android_BatteryBot_ClickFraud.yar similarity index 100% rename from Mobile_Malware/Android_BatteryBot_ClickFraud.yar rename to deprecated/Android_BatteryBot_ClickFraud.yar diff --git a/Mobile_Malware/Android_Clicker_G.yar b/deprecated/Android_Clicker_G.yar similarity index 100% rename from Mobile_Malware/Android_Clicker_G.yar rename to deprecated/Android_Clicker_G.yar diff --git a/Mobile_Malware/Android_Copy9.yar b/deprecated/Android_Copy9.yar similarity index 100% rename from Mobile_Malware/Android_Copy9.yar rename to deprecated/Android_Copy9.yar diff --git a/Mobile_Malware/Android_DeathRing.yar b/deprecated/Android_DeathRing.yar similarity index 100% rename from Mobile_Malware/Android_DeathRing.yar rename to deprecated/Android_DeathRing.yar diff --git a/Mobile_Malware/Android_Dectus_rswm.yar b/deprecated/Android_Dectus_rswm.yar similarity index 100% rename from Mobile_Malware/Android_Dectus_rswm.yar rename to deprecated/Android_Dectus_rswm.yar diff --git a/Mobile_Malware/Android_Dendroid_RAT.yar b/deprecated/Android_Dendroid_RAT.yar similarity index 100% rename from Mobile_Malware/Android_Dendroid_RAT.yar rename to deprecated/Android_Dendroid_RAT.yar diff --git a/Mobile_Malware/Android_Dogspectus.yar b/deprecated/Android_Dogspectus.yar similarity index 100% rename from Mobile_Malware/Android_Dogspectus.yar rename to deprecated/Android_Dogspectus.yar diff --git a/Mobile_Malware/Android_FakeApps.yar b/deprecated/Android_FakeApps.yar similarity index 100% rename from Mobile_Malware/Android_FakeApps.yar rename to deprecated/Android_FakeApps.yar diff --git a/Mobile_Malware/Android_FakeBank_Fanta.yar b/deprecated/Android_FakeBank_Fanta.yar similarity index 100% rename from Mobile_Malware/Android_FakeBank_Fanta.yar rename to deprecated/Android_FakeBank_Fanta.yar diff --git a/Mobile_Malware/Android_Godless.yar b/deprecated/Android_Godless.yar similarity index 100% rename from Mobile_Malware/Android_Godless.yar rename to deprecated/Android_Godless.yar diff --git a/Mobile_Malware/Android_HackintTeam_Implant.yar b/deprecated/Android_HackintTeam_Implant.yar similarity index 100% rename from Mobile_Malware/Android_HackintTeam_Implant.yar rename to deprecated/Android_HackintTeam_Implant.yar diff --git a/Mobile_Malware/Android_Libyan_Scorpions.yar b/deprecated/Android_Libyan_Scorpions.yar similarity index 100% rename from Mobile_Malware/Android_Libyan_Scorpions.yar rename to deprecated/Android_Libyan_Scorpions.yar diff --git a/Mobile_Malware/Android_MalwareCertificates.yar b/deprecated/Android_MalwareCertificates.yar similarity index 100% rename from Mobile_Malware/Android_MalwareCertificates.yar rename to deprecated/Android_MalwareCertificates.yar diff --git a/Mobile_Malware/Android_Malware_Ramsonware.yar b/deprecated/Android_Malware_Ramsonware.yar similarity index 100% rename from Mobile_Malware/Android_Malware_Ramsonware.yar rename to deprecated/Android_Malware_Ramsonware.yar diff --git a/Mobile_Malware/Android_Malware_Tinhvan.yar b/deprecated/Android_Malware_Tinhvan.yar similarity index 100% rename from Mobile_Malware/Android_Malware_Tinhvan.yar rename to deprecated/Android_Malware_Tinhvan.yar diff --git a/Mobile_Malware/Android_Malware_Towelroot.yar b/deprecated/Android_Malware_Towelroot.yar similarity index 100% rename from Mobile_Malware/Android_Malware_Towelroot.yar rename to deprecated/Android_Malware_Towelroot.yar diff --git a/Mobile_Malware/Android_Marcher_2.yar b/deprecated/Android_Marcher_2.yar similarity index 100% rename from Mobile_Malware/Android_Marcher_2.yar rename to deprecated/Android_Marcher_2.yar diff --git a/Mobile_Malware/Android_MazarBot_z.yar b/deprecated/Android_MazarBot_z.yar similarity index 100% rename from Mobile_Malware/Android_MazarBot_z.yar rename to deprecated/Android_MazarBot_z.yar diff --git a/Mobile_Malware/Android_Metasploit.yar b/deprecated/Android_Metasploit.yar similarity index 100% rename from Mobile_Malware/Android_Metasploit.yar rename to deprecated/Android_Metasploit.yar diff --git a/Mobile_Malware/Android_Metasploit_Payload.yar b/deprecated/Android_Metasploit_Payload.yar similarity index 100% rename from Mobile_Malware/Android_Metasploit_Payload.yar rename to deprecated/Android_Metasploit_Payload.yar diff --git a/Mobile_Malware/Android_OmniRat.yar b/deprecated/Android_OmniRat.yar similarity index 100% rename from Mobile_Malware/Android_OmniRat.yar rename to deprecated/Android_OmniRat.yar diff --git a/Mobile_Malware/Android_Overlayer.yar b/deprecated/Android_Overlayer.yar similarity index 100% rename from Mobile_Malware/Android_Overlayer.yar rename to deprecated/Android_Overlayer.yar diff --git a/Mobile_Malware/Android_Pink_Locker.yar b/deprecated/Android_Pink_Locker.yar similarity index 100% rename from Mobile_Malware/Android_Pink_Locker.yar rename to deprecated/Android_Pink_Locker.yar diff --git a/Mobile_Malware/Android_Polish_Bankbot.yar b/deprecated/Android_Polish_Bankbot.yar similarity index 100% rename from Mobile_Malware/Android_Polish_Bankbot.yar rename to deprecated/Android_Polish_Bankbot.yar diff --git a/Mobile_Malware/Android_RuMMS.yar b/deprecated/Android_RuMMS.yar similarity index 100% rename from Mobile_Malware/Android_RuMMS.yar rename to deprecated/Android_RuMMS.yar diff --git a/Mobile_Malware/Android_SMSFraud.yar b/deprecated/Android_SMSFraud.yar similarity index 100% rename from Mobile_Malware/Android_SMSFraud.yar rename to deprecated/Android_SMSFraud.yar diff --git a/Mobile_Malware/Android_SandroRat.yar b/deprecated/Android_SandroRat.yar similarity index 100% rename from Mobile_Malware/Android_SandroRat.yar rename to deprecated/Android_SandroRat.yar diff --git a/Mobile_Malware/Android_SlemBunk.yar b/deprecated/Android_SlemBunk.yar similarity index 100% rename from Mobile_Malware/Android_SlemBunk.yar rename to deprecated/Android_SlemBunk.yar diff --git a/Mobile_Malware/Android_SpyAgent.yar b/deprecated/Android_SpyAgent.yar similarity index 100% rename from Mobile_Malware/Android_SpyAgent.yar rename to deprecated/Android_SpyAgent.yar diff --git a/Mobile_Malware/Android_SpyNote.yar b/deprecated/Android_SpyNote.yar similarity index 100% rename from Mobile_Malware/Android_SpyNote.yar rename to deprecated/Android_SpyNote.yar diff --git a/Mobile_Malware/Android_Spynet.yar b/deprecated/Android_Spynet.yar similarity index 100% rename from Mobile_Malware/Android_Spynet.yar rename to deprecated/Android_Spynet.yar diff --git a/Mobile_Malware/Android_Spywaller.yar b/deprecated/Android_Spywaller.yar similarity index 100% rename from Mobile_Malware/Android_Spywaller.yar rename to deprecated/Android_Spywaller.yar diff --git a/Mobile_Malware/Android_Switcher.yar b/deprecated/Android_Switcher.yar similarity index 100% rename from Mobile_Malware/Android_Switcher.yar rename to deprecated/Android_Switcher.yar diff --git a/Mobile_Malware/Android_Tachi.yar b/deprecated/Android_Tachi.yar similarity index 100% rename from Mobile_Malware/Android_Tachi.yar rename to deprecated/Android_Tachi.yar diff --git a/Mobile_Malware/Android_Tempting_Cedar_Spyware.yar b/deprecated/Android_Tempting_Cedar_Spyware.yar similarity index 100% rename from Mobile_Malware/Android_Tempting_Cedar_Spyware.yar rename to deprecated/Android_Tempting_Cedar_Spyware.yar diff --git a/Mobile_Malware/Android_Tordow.yar b/deprecated/Android_Tordow.yar similarity index 100% rename from Mobile_Malware/Android_Tordow.yar rename to deprecated/Android_Tordow.yar diff --git a/Mobile_Malware/Android_Triada_Banking.yar b/deprecated/Android_Triada_Banking.yar similarity index 100% rename from Mobile_Malware/Android_Triada_Banking.yar rename to deprecated/Android_Triada_Banking.yar diff --git a/Mobile_Malware/Android_Trojan_Dendroid.yar b/deprecated/Android_Trojan_Dendroid.yar similarity index 100% rename from Mobile_Malware/Android_Trojan_Dendroid.yar rename to deprecated/Android_Trojan_Dendroid.yar diff --git a/Mobile_Malware/Android_Trojan_Droidjack.yar b/deprecated/Android_Trojan_Droidjack.yar similarity index 100% rename from Mobile_Malware/Android_Trojan_Droidjack.yar rename to deprecated/Android_Trojan_Droidjack.yar diff --git a/Mobile_Malware/Android_VikingOrder.yar b/deprecated/Android_VikingOrder.yar similarity index 100% rename from Mobile_Malware/Android_VikingOrder.yar rename to deprecated/Android_VikingOrder.yar diff --git a/Mobile_Malware/Android_VirusPolicia.yar b/deprecated/Android_VirusPolicia.yar similarity index 100% rename from Mobile_Malware/Android_VirusPolicia.yar rename to deprecated/Android_VirusPolicia.yar diff --git a/Mobile_Malware/Android_adware.yar b/deprecated/Android_adware.yar similarity index 100% rename from Mobile_Malware/Android_adware.yar rename to deprecated/Android_adware.yar diff --git a/Mobile_Malware/Android_fake_mario_app b/deprecated/Android_fake_mario_app similarity index 100% rename from Mobile_Malware/Android_fake_mario_app rename to deprecated/Android_fake_mario_app diff --git a/Mobile_Malware/Android_generic_adware.yar b/deprecated/Android_generic_adware.yar similarity index 100% rename from Mobile_Malware/Android_generic_adware.yar rename to deprecated/Android_generic_adware.yar diff --git a/Mobile_Malware/Android_generic_smsfraud.yar b/deprecated/Android_generic_smsfraud.yar similarity index 100% rename from Mobile_Malware/Android_generic_smsfraud.yar rename to deprecated/Android_generic_smsfraud.yar diff --git a/Mobile_Malware/Android_malware_Advertising.yar b/deprecated/Android_malware_Advertising.yar similarity index 100% rename from Mobile_Malware/Android_malware_Advertising.yar rename to deprecated/Android_malware_Advertising.yar diff --git a/Mobile_Malware/Android_malware_ChinesePorn.yar b/deprecated/Android_malware_ChinesePorn.yar similarity index 100% rename from Mobile_Malware/Android_malware_ChinesePorn.yar rename to deprecated/Android_malware_ChinesePorn.yar diff --git a/Mobile_Malware/Android_malware_Dropper.yar b/deprecated/Android_malware_Dropper.yar similarity index 100% rename from Mobile_Malware/Android_malware_Dropper.yar rename to deprecated/Android_malware_Dropper.yar diff --git a/Mobile_Malware/Android_malware_Fake_MosKow.yar b/deprecated/Android_malware_Fake_MosKow.yar similarity index 100% rename from Mobile_Malware/Android_malware_Fake_MosKow.yar rename to deprecated/Android_malware_Fake_MosKow.yar diff --git a/Mobile_Malware/Android_malware_HackingTeam.yar b/deprecated/Android_malware_HackingTeam.yar similarity index 100% rename from Mobile_Malware/Android_malware_HackingTeam.yar rename to deprecated/Android_malware_HackingTeam.yar diff --git a/Mobile_Malware/Android_malware_SMSsender.yar b/deprecated/Android_malware_SMSsender.yar similarity index 100% rename from Mobile_Malware/Android_malware_SMSsender.yar rename to deprecated/Android_malware_SMSsender.yar diff --git a/Mobile_Malware/Android_malware_banker.yar b/deprecated/Android_malware_banker.yar similarity index 100% rename from Mobile_Malware/Android_malware_banker.yar rename to deprecated/Android_malware_banker.yar diff --git a/Mobile_Malware/Android_malware_xbot007.yar b/deprecated/Android_malware_xbot007.yar similarity index 100% rename from Mobile_Malware/Android_malware_xbot007.yar rename to deprecated/Android_malware_xbot007.yar diff --git a/Mobile_Malware/Android_mapin.yar b/deprecated/Android_mapin.yar similarity index 100% rename from Mobile_Malware/Android_mapin.yar rename to deprecated/Android_mapin.yar diff --git a/Mobile_Malware/Android_pornClicker.yar b/deprecated/Android_pornClicker.yar similarity index 100% rename from Mobile_Malware/Android_pornClicker.yar rename to deprecated/Android_pornClicker.yar diff --git a/Mobile_Malware/Android_sk_bankTr.yar b/deprecated/Android_sk_bankTr.yar similarity index 100% rename from Mobile_Malware/Android_sk_bankTr.yar rename to deprecated/Android_sk_bankTr.yar diff --git a/email_index.yar b/email_index.yar index 6ba261be..af7140f5 100644 --- a/email_index.yar +++ b/email_index.yar @@ -1,6 +1,6 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ include "./email/EMAIL_Cryptowall.yar" include "./email/attachment.yar" diff --git a/Exploit-Kits/EK_Angler.yar b/exploit_kits/EK_Angler.yar similarity index 100% rename from Exploit-Kits/EK_Angler.yar rename to exploit_kits/EK_Angler.yar diff --git a/Exploit-Kits/EK_Blackhole.yar b/exploit_kits/EK_Blackhole.yar similarity index 100% rename from Exploit-Kits/EK_Blackhole.yar rename to exploit_kits/EK_Blackhole.yar diff --git a/Exploit-Kits/EK_BleedingLife.yar b/exploit_kits/EK_BleedingLife.yar similarity index 100% rename from Exploit-Kits/EK_BleedingLife.yar rename to exploit_kits/EK_BleedingLife.yar diff --git a/Exploit-Kits/EK_Crimepack.yar b/exploit_kits/EK_Crimepack.yar similarity index 100% rename from Exploit-Kits/EK_Crimepack.yar rename to exploit_kits/EK_Crimepack.yar diff --git a/Exploit-Kits/EK_Eleonore.yar b/exploit_kits/EK_Eleonore.yar similarity index 100% rename from Exploit-Kits/EK_Eleonore.yar rename to exploit_kits/EK_Eleonore.yar diff --git a/Exploit-Kits/EK_Fragus.yar b/exploit_kits/EK_Fragus.yar similarity index 100% rename from Exploit-Kits/EK_Fragus.yar rename to exploit_kits/EK_Fragus.yar diff --git a/Exploit-Kits/EK_Phoenix.yar b/exploit_kits/EK_Phoenix.yar similarity index 100% rename from Exploit-Kits/EK_Phoenix.yar rename to exploit_kits/EK_Phoenix.yar diff --git a/Exploit-Kits/EK_Sakura.yar b/exploit_kits/EK_Sakura.yar similarity index 100% rename from Exploit-Kits/EK_Sakura.yar rename to exploit_kits/EK_Sakura.yar diff --git a/Exploit-Kits/EK_ZeroAcces.yar b/exploit_kits/EK_ZeroAcces.yar similarity index 100% rename from Exploit-Kits/EK_ZeroAcces.yar rename to exploit_kits/EK_ZeroAcces.yar diff --git a/Exploit-Kits/EK_Zerox88.yar b/exploit_kits/EK_Zerox88.yar similarity index 100% rename from Exploit-Kits/EK_Zerox88.yar rename to exploit_kits/EK_Zerox88.yar diff --git a/Exploit-Kits/EK_Zeus.yar b/exploit_kits/EK_Zeus.yar similarity index 100% rename from Exploit-Kits/EK_Zeus.yar rename to exploit_kits/EK_Zeus.yar diff --git a/exploit_kits_index.yar b/exploit_kits_index.yar new file mode 100644 index 00000000..37ac29c2 --- /dev/null +++ b/exploit_kits_index.yar @@ -0,0 +1,15 @@ +/* +Generated by Yara-Rules +On 08-01-2020 +*/ +include "./exploit_kits/EK_Angler.yar" +include "./exploit_kits/EK_Blackhole.yar" +include "./exploit_kits/EK_BleedingLife.yar" +include "./exploit_kits/EK_Crimepack.yar" +include "./exploit_kits/EK_Eleonore.yar" +include "./exploit_kits/EK_Fragus.yar" +include "./exploit_kits/EK_Phoenix.yar" +include "./exploit_kits/EK_Sakura.yar" +include "./exploit_kits/EK_ZeroAcces.yar" +include "./exploit_kits/EK_Zerox88.yar" +include "./exploit_kits/EK_Zeus.yar" diff --git a/index.yar b/index.yar index eb18499f..18d41a48 100644 --- a/index.yar +++ b/index.yar @@ -1,66 +1,24 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Antidebug_AntiVM/antidebug_antivm.yar" -include "./CVE_Rules/CVE-2010-0805.yar" -include "./CVE_Rules/CVE-2010-0887.yar" -include "./CVE_Rules/CVE-2010-1297.yar" -include "./CVE_Rules/CVE-2012-0158.yar" -include "./CVE_Rules/CVE-2013-0074.yar" -include "./CVE_Rules/CVE-2013-0422.yar" -include "./CVE_Rules/CVE-2015-1701.yar" -include "./CVE_Rules/CVE-2015-2426.yar" -include "./CVE_Rules/CVE-2015-2545.yar" -include "./CVE_Rules/CVE-2015-5119.yar" -include "./CVE_Rules/CVE-2016-5195.yar" -include "./CVE_Rules/CVE-2017-11882.yar" -include "./CVE_Rules/CVE-2018-20250.yar" -include "./CVE_Rules/CVE-2018-4878.yar" -include "./Capabilities/capabilities.yar" -include "./Crypto/crypto_signatures.yar" -include "./Exploit-Kits/EK_Angler.yar" -include "./Exploit-Kits/EK_Blackhole.yar" -include "./Exploit-Kits/EK_BleedingLife.yar" -include "./Exploit-Kits/EK_Crimepack.yar" -include "./Exploit-Kits/EK_Eleonore.yar" -include "./Exploit-Kits/EK_Fragus.yar" -include "./Exploit-Kits/EK_Phoenix.yar" -include "./Exploit-Kits/EK_Sakura.yar" -include "./Exploit-Kits/EK_ZeroAcces.yar" -include "./Exploit-Kits/EK_Zerox88.yar" -include "./Exploit-Kits/EK_Zeus.yar" -include "./Malicious_Documents/Maldoc_APT10_MenuPass.yar" -include "./Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar" -include "./Malicious_Documents/Maldoc_APT_OLE_JSRat.yar" -include "./Malicious_Documents/Maldoc_CVE-2017-0199.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_11882.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_8759.yar" -include "./Malicious_Documents/Maldoc_Contains_VBE_File.yar" -include "./Malicious_Documents/Maldoc_DDE.yar" -include "./Malicious_Documents/Maldoc_Dridex.yar" -include "./Malicious_Documents/Maldoc_Hidden_PE_file.yar" -include "./Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar" -include "./Malicious_Documents/Maldoc_PDF.yar" -include "./Malicious_Documents/Maldoc_PowerPointMouse.yar" -include "./Malicious_Documents/Maldoc_Suspicious_OLE_target.yar" -include "./Malicious_Documents/Maldoc_UserForm.yar" -include "./Malicious_Documents/Maldoc_VBA_macro_code.yar" -include "./Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar" -include "./Malicious_Documents/Maldoc_malrtf_ole2link.yar" -include "./Malicious_Documents/maldoc_somerules.yar" -include "./Packers/JJencode.yar" -include "./Packers/Javascript_exploit_and_obfuscation.yar" -include "./Packers/packer.yar" -include "./Packers/packer_compiler_signatures.yar" -include "./Packers/peid.yar" -include "./Webshells/WShell_APT_Laudanum.yar" -include "./Webshells/WShell_ASPXSpy.yar" -include "./Webshells/WShell_PHP_Anuna.yar" -include "./Webshells/WShell_PHP_in_images.yar" -include "./Webshells/WShell_THOR_Webshells.yar" -include "./Webshells/Wshell_ChineseSpam.yar" -include "./Webshells/Wshell_fire2013.yar" +include "./antidebug_antivm/antidebug_antivm.yar" +include "./capabilities/capabilities.yar" +include "./crypto/crypto_signatures.yar" +include "./cve_rules/CVE-2010-0805.yar" +include "./cve_rules/CVE-2010-0887.yar" +include "./cve_rules/CVE-2010-1297.yar" +include "./cve_rules/CVE-2012-0158.yar" +include "./cve_rules/CVE-2013-0074.yar" +include "./cve_rules/CVE-2013-0422.yar" +include "./cve_rules/CVE-2015-1701.yar" +include "./cve_rules/CVE-2015-2426.yar" +include "./cve_rules/CVE-2015-2545.yar" +include "./cve_rules/CVE-2015-5119.yar" +include "./cve_rules/CVE-2016-5195.yar" +include "./cve_rules/CVE-2017-11882.yar" +include "./cve_rules/CVE-2018-20250.yar" +include "./cve_rules/CVE-2018-4878.yar" include "./email/EMAIL_Cryptowall.yar" include "./email/attachment.yar" include "./email/bank_rule.yar" @@ -68,6 +26,36 @@ include "./email/email_Ukraine_BE_powerattack.yar" include "./email/image.yar" include "./email/scam.yar" include "./email/urls.yar" +include "./exploit_kits/EK_Angler.yar" +include "./exploit_kits/EK_Blackhole.yar" +include "./exploit_kits/EK_BleedingLife.yar" +include "./exploit_kits/EK_Crimepack.yar" +include "./exploit_kits/EK_Eleonore.yar" +include "./exploit_kits/EK_Fragus.yar" +include "./exploit_kits/EK_Phoenix.yar" +include "./exploit_kits/EK_Sakura.yar" +include "./exploit_kits/EK_ZeroAcces.yar" +include "./exploit_kits/EK_Zerox88.yar" +include "./exploit_kits/EK_Zeus.yar" +include "./maldocs/Maldoc_APT10_MenuPass.yar" +include "./maldocs/Maldoc_APT19_CVE-2017-1099.yar" +include "./maldocs/Maldoc_APT_OLE_JSRat.yar" +include "./maldocs/Maldoc_CVE-2017-0199.yar" +include "./maldocs/Maldoc_CVE_2017_11882.yar" +include "./maldocs/Maldoc_CVE_2017_8759.yar" +include "./maldocs/Maldoc_Contains_VBE_File.yar" +include "./maldocs/Maldoc_DDE.yar" +include "./maldocs/Maldoc_Dridex.yar" +include "./maldocs/Maldoc_Hidden_PE_file.yar" +include "./maldocs/Maldoc_MIME_ActiveMime_b64.yar" +include "./maldocs/Maldoc_PDF.yar" +include "./maldocs/Maldoc_PowerPointMouse.yar" +include "./maldocs/Maldoc_Suspicious_OLE_target.yar" +include "./maldocs/Maldoc_UserForm.yar" +include "./maldocs/Maldoc_VBA_macro_code.yar" +include "./maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar" +include "./maldocs/Maldoc_malrtf_ole2link.yar" +include "./maldocs/maldoc_somerules.yar" include "./malware/000_common_rules.yar" include "./malware/APT_APT1.yar" include "./malware/APT_APT10.yar" @@ -204,6 +192,7 @@ include "./malware/MALW_Exploit_UAC_Elevators.yar" include "./malware/MALW_Ezcob.yar" include "./malware/MALW_F0xy.yar" include "./malware/MALW_FALLCHILL.yar" +include "./malware/MALW_FUDCrypt.yar" include "./malware/MALW_FakeM.yar" include "./malware/MALW_Fareit.yar" include "./malware/MALW_Favorite.yar" @@ -240,6 +229,7 @@ include "./malware/MALW_LinuxMoose.yar" include "./malware/MALW_LostDoor.yar" include "./malware/MALW_LuaBot.yar" include "./malware/MALW_LuckyCat.yar" +include "./malware/MALW_MSILStealer.yar" include "./malware/MALW_MacControl.yar" include "./malware/MALW_Madness.yar" include "./malware/MALW_Magento_backend.yar" @@ -390,6 +380,7 @@ include "./malware/RANSOM_GPGQwerty.yar" include "./malware/RANSOM_GoldenEye.yar" include "./malware/RANSOM_Locky.yar" include "./malware/RANSOM_MS17-010_Wannacrypt.yar" +include "./malware/RANSOM_Maze.yar" include "./malware/RANSOM_PetrWrap.yar" include "./malware/RANSOM_Petya.yar" include "./malware/RANSOM_SamSam.yar" @@ -443,3 +434,16 @@ include "./malware/TOOLKIT_Pwdump.yar" include "./malware/TOOLKIT_THOR_HackTools.yar" include "./malware/TOOLKIT_Wineggdrop.yar" include "./malware/TOOLKIT_exe2hex_payload.yar" +include "./packers/JJencode.yar" +include "./packers/Javascript_exploit_and_obfuscation.yar" +include "./packers/packer.yar" +include "./packers/packer_compiler_signatures.yar" +include "./packers/peid.yar" +include "./webshells/WShell_APT_Laudanum.yar" +include "./webshells/WShell_ASPXSpy.yar" +include "./webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_PHP_Anuna.yar" +include "./webshells/WShell_PHP_in_images.yar" +include "./webshells/WShell_THOR_Webshells.yar" +include "./webshells/Wshell_ChineseSpam.yar" +include "./webshells/Wshell_fire2013.yar" diff --git a/index_gen.sh b/index_gen.sh index e0a3469d..d988a793 100755 --- a/index_gen.sh +++ b/index_gen.sh @@ -2,7 +2,8 @@ function get_folders { local INDECES=() - for folder in $(ls -d */ | grep -v utils); do + AVOID="utils|deprecated" + for folder in $(ls -d */ | grep -vE $AVOID); do INDECES+="$folder " done INDECES+=". " @@ -18,7 +19,7 @@ function gen_index { echo -e "/*$4*/" > $IDX_NAME fi OS=$(uname) - AVOID="_?index.yara?|index_|utils" + AVOID="_?index.yara?|index_|utils|deprecated" if [ x"$BASE" == x"." ]; then if [ $INC_MOBILE == false ]; then AVOID+="|Mobile" diff --git a/index_w_mobile.yar b/index_w_mobile.yar index 857c6e60..18d41a48 100644 --- a/index_w_mobile.yar +++ b/index_w_mobile.yar @@ -1,129 +1,24 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ -include "./Antidebug_AntiVM/antidebug_antivm.yar" -include "./CVE_Rules/CVE-2010-0805.yar" -include "./CVE_Rules/CVE-2010-0887.yar" -include "./CVE_Rules/CVE-2010-1297.yar" -include "./CVE_Rules/CVE-2012-0158.yar" -include "./CVE_Rules/CVE-2013-0074.yar" -include "./CVE_Rules/CVE-2013-0422.yar" -include "./CVE_Rules/CVE-2015-1701.yar" -include "./CVE_Rules/CVE-2015-2426.yar" -include "./CVE_Rules/CVE-2015-2545.yar" -include "./CVE_Rules/CVE-2015-5119.yar" -include "./CVE_Rules/CVE-2016-5195.yar" -include "./CVE_Rules/CVE-2017-11882.yar" -include "./CVE_Rules/CVE-2018-20250.yar" -include "./CVE_Rules/CVE-2018-4878.yar" -include "./Capabilities/capabilities.yar" -include "./Crypto/crypto_signatures.yar" -include "./Exploit-Kits/EK_Angler.yar" -include "./Exploit-Kits/EK_Blackhole.yar" -include "./Exploit-Kits/EK_BleedingLife.yar" -include "./Exploit-Kits/EK_Crimepack.yar" -include "./Exploit-Kits/EK_Eleonore.yar" -include "./Exploit-Kits/EK_Fragus.yar" -include "./Exploit-Kits/EK_Phoenix.yar" -include "./Exploit-Kits/EK_Sakura.yar" -include "./Exploit-Kits/EK_ZeroAcces.yar" -include "./Exploit-Kits/EK_Zerox88.yar" -include "./Exploit-Kits/EK_Zeus.yar" -include "./Malicious_Documents/Maldoc_APT10_MenuPass.yar" -include "./Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar" -include "./Malicious_Documents/Maldoc_APT_OLE_JSRat.yar" -include "./Malicious_Documents/Maldoc_CVE-2017-0199.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_11882.yar" -include "./Malicious_Documents/Maldoc_CVE_2017_8759.yar" -include "./Malicious_Documents/Maldoc_Contains_VBE_File.yar" -include "./Malicious_Documents/Maldoc_DDE.yar" -include "./Malicious_Documents/Maldoc_Dridex.yar" -include "./Malicious_Documents/Maldoc_Hidden_PE_file.yar" -include "./Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar" -include "./Malicious_Documents/Maldoc_PDF.yar" -include "./Malicious_Documents/Maldoc_PowerPointMouse.yar" -include "./Malicious_Documents/Maldoc_Suspicious_OLE_target.yar" -include "./Malicious_Documents/Maldoc_UserForm.yar" -include "./Malicious_Documents/Maldoc_VBA_macro_code.yar" -include "./Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar" -include "./Malicious_Documents/Maldoc_malrtf_ole2link.yar" -include "./Malicious_Documents/maldoc_somerules.yar" -include "./Mobile_Malware/Android_ASSDdeveloper.yar" -include "./Mobile_Malware/Android_AVITOMMS.yar" -include "./Mobile_Malware/Android_AliPay_smsStealer.yar" -include "./Mobile_Malware/Android_Amtrckr_20160519.yar" -include "./Mobile_Malware/Android_Backdoor.yar" -include "./Mobile_Malware/Android_Backdoor_script.yar" -include "./Mobile_Malware/Android_BadMirror.yar" -include "./Mobile_Malware/Android_Banker_Acecard.yar" -include "./Mobile_Malware/Android_BatteryBot_ClickFraud.yar" -include "./Mobile_Malware/Android_Clicker_G.yar" -include "./Mobile_Malware/Android_Copy9.yar" -include "./Mobile_Malware/Android_DeathRing.yar" -include "./Mobile_Malware/Android_Dectus_rswm.yar" -include "./Mobile_Malware/Android_Dendroid_RAT.yar" -include "./Mobile_Malware/Android_Dogspectus.yar" -include "./Mobile_Malware/Android_FakeApps.yar" -include "./Mobile_Malware/Android_FakeBank_Fanta.yar" -include "./Mobile_Malware/Android_Godless.yar" -include "./Mobile_Malware/Android_HackintTeam_Implant.yar" -include "./Mobile_Malware/Android_Libyan_Scorpions.yar" -include "./Mobile_Malware/Android_MalwareCertificates.yar" -include "./Mobile_Malware/Android_Malware_Ramsonware.yar" -include "./Mobile_Malware/Android_Malware_Tinhvan.yar" -include "./Mobile_Malware/Android_Malware_Towelroot.yar" -include "./Mobile_Malware/Android_Marcher_2.yar" -include "./Mobile_Malware/Android_MazarBot_z.yar" -include "./Mobile_Malware/Android_Metasploit.yar" -include "./Mobile_Malware/Android_Metasploit_Payload.yar" -include "./Mobile_Malware/Android_OmniRat.yar" -include "./Mobile_Malware/Android_Overlayer.yar" -include "./Mobile_Malware/Android_Pink_Locker.yar" -include "./Mobile_Malware/Android_Polish_Bankbot.yar" -include "./Mobile_Malware/Android_RuMMS.yar" -include "./Mobile_Malware/Android_SMSFraud.yar" -include "./Mobile_Malware/Android_SandroRat.yar" -include "./Mobile_Malware/Android_SlemBunk.yar" -include "./Mobile_Malware/Android_SpyAgent.yar" -include "./Mobile_Malware/Android_SpyNote.yar" -include "./Mobile_Malware/Android_Spynet.yar" -include "./Mobile_Malware/Android_Spywaller.yar" -include "./Mobile_Malware/Android_Switcher.yar" -include "./Mobile_Malware/Android_Tachi.yar" -include "./Mobile_Malware/Android_Tempting_Cedar_Spyware.yar" -include "./Mobile_Malware/Android_Tordow.yar" -include "./Mobile_Malware/Android_Triada_Banking.yar" -include "./Mobile_Malware/Android_Trojan_Dendroid.yar" -include "./Mobile_Malware/Android_Trojan_Droidjack.yar" -include "./Mobile_Malware/Android_VikingOrder.yar" -include "./Mobile_Malware/Android_VirusPolicia.yar" -include "./Mobile_Malware/Android_adware.yar" -include "./Mobile_Malware/Android_generic_adware.yar" -include "./Mobile_Malware/Android_generic_smsfraud.yar" -include "./Mobile_Malware/Android_malware_Advertising.yar" -include "./Mobile_Malware/Android_malware_ChinesePorn.yar" -include "./Mobile_Malware/Android_malware_Dropper.yar" -include "./Mobile_Malware/Android_malware_Fake_MosKow.yar" -include "./Mobile_Malware/Android_malware_HackingTeam.yar" -include "./Mobile_Malware/Android_malware_SMSsender.yar" -include "./Mobile_Malware/Android_malware_banker.yar" -include "./Mobile_Malware/Android_malware_xbot007.yar" -include "./Mobile_Malware/Android_mapin.yar" -include "./Mobile_Malware/Android_pornClicker.yar" -include "./Mobile_Malware/Android_sk_bankTr.yar" -include "./Packers/JJencode.yar" -include "./Packers/Javascript_exploit_and_obfuscation.yar" -include "./Packers/packer.yar" -include "./Packers/packer_compiler_signatures.yar" -include "./Packers/peid.yar" -include "./Webshells/WShell_APT_Laudanum.yar" -include "./Webshells/WShell_ASPXSpy.yar" -include "./Webshells/WShell_PHP_Anuna.yar" -include "./Webshells/WShell_PHP_in_images.yar" -include "./Webshells/WShell_THOR_Webshells.yar" -include "./Webshells/Wshell_ChineseSpam.yar" -include "./Webshells/Wshell_fire2013.yar" +include "./antidebug_antivm/antidebug_antivm.yar" +include "./capabilities/capabilities.yar" +include "./crypto/crypto_signatures.yar" +include "./cve_rules/CVE-2010-0805.yar" +include "./cve_rules/CVE-2010-0887.yar" +include "./cve_rules/CVE-2010-1297.yar" +include "./cve_rules/CVE-2012-0158.yar" +include "./cve_rules/CVE-2013-0074.yar" +include "./cve_rules/CVE-2013-0422.yar" +include "./cve_rules/CVE-2015-1701.yar" +include "./cve_rules/CVE-2015-2426.yar" +include "./cve_rules/CVE-2015-2545.yar" +include "./cve_rules/CVE-2015-5119.yar" +include "./cve_rules/CVE-2016-5195.yar" +include "./cve_rules/CVE-2017-11882.yar" +include "./cve_rules/CVE-2018-20250.yar" +include "./cve_rules/CVE-2018-4878.yar" include "./email/EMAIL_Cryptowall.yar" include "./email/attachment.yar" include "./email/bank_rule.yar" @@ -131,6 +26,36 @@ include "./email/email_Ukraine_BE_powerattack.yar" include "./email/image.yar" include "./email/scam.yar" include "./email/urls.yar" +include "./exploit_kits/EK_Angler.yar" +include "./exploit_kits/EK_Blackhole.yar" +include "./exploit_kits/EK_BleedingLife.yar" +include "./exploit_kits/EK_Crimepack.yar" +include "./exploit_kits/EK_Eleonore.yar" +include "./exploit_kits/EK_Fragus.yar" +include "./exploit_kits/EK_Phoenix.yar" +include "./exploit_kits/EK_Sakura.yar" +include "./exploit_kits/EK_ZeroAcces.yar" +include "./exploit_kits/EK_Zerox88.yar" +include "./exploit_kits/EK_Zeus.yar" +include "./maldocs/Maldoc_APT10_MenuPass.yar" +include "./maldocs/Maldoc_APT19_CVE-2017-1099.yar" +include "./maldocs/Maldoc_APT_OLE_JSRat.yar" +include "./maldocs/Maldoc_CVE-2017-0199.yar" +include "./maldocs/Maldoc_CVE_2017_11882.yar" +include "./maldocs/Maldoc_CVE_2017_8759.yar" +include "./maldocs/Maldoc_Contains_VBE_File.yar" +include "./maldocs/Maldoc_DDE.yar" +include "./maldocs/Maldoc_Dridex.yar" +include "./maldocs/Maldoc_Hidden_PE_file.yar" +include "./maldocs/Maldoc_MIME_ActiveMime_b64.yar" +include "./maldocs/Maldoc_PDF.yar" +include "./maldocs/Maldoc_PowerPointMouse.yar" +include "./maldocs/Maldoc_Suspicious_OLE_target.yar" +include "./maldocs/Maldoc_UserForm.yar" +include "./maldocs/Maldoc_VBA_macro_code.yar" +include "./maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar" +include "./maldocs/Maldoc_malrtf_ole2link.yar" +include "./maldocs/maldoc_somerules.yar" include "./malware/000_common_rules.yar" include "./malware/APT_APT1.yar" include "./malware/APT_APT10.yar" @@ -267,6 +192,7 @@ include "./malware/MALW_Exploit_UAC_Elevators.yar" include "./malware/MALW_Ezcob.yar" include "./malware/MALW_F0xy.yar" include "./malware/MALW_FALLCHILL.yar" +include "./malware/MALW_FUDCrypt.yar" include "./malware/MALW_FakeM.yar" include "./malware/MALW_Fareit.yar" include "./malware/MALW_Favorite.yar" @@ -303,6 +229,7 @@ include "./malware/MALW_LinuxMoose.yar" include "./malware/MALW_LostDoor.yar" include "./malware/MALW_LuaBot.yar" include "./malware/MALW_LuckyCat.yar" +include "./malware/MALW_MSILStealer.yar" include "./malware/MALW_MacControl.yar" include "./malware/MALW_Madness.yar" include "./malware/MALW_Magento_backend.yar" @@ -453,6 +380,7 @@ include "./malware/RANSOM_GPGQwerty.yar" include "./malware/RANSOM_GoldenEye.yar" include "./malware/RANSOM_Locky.yar" include "./malware/RANSOM_MS17-010_Wannacrypt.yar" +include "./malware/RANSOM_Maze.yar" include "./malware/RANSOM_PetrWrap.yar" include "./malware/RANSOM_Petya.yar" include "./malware/RANSOM_SamSam.yar" @@ -506,3 +434,16 @@ include "./malware/TOOLKIT_Pwdump.yar" include "./malware/TOOLKIT_THOR_HackTools.yar" include "./malware/TOOLKIT_Wineggdrop.yar" include "./malware/TOOLKIT_exe2hex_payload.yar" +include "./packers/JJencode.yar" +include "./packers/Javascript_exploit_and_obfuscation.yar" +include "./packers/packer.yar" +include "./packers/packer_compiler_signatures.yar" +include "./packers/peid.yar" +include "./webshells/WShell_APT_Laudanum.yar" +include "./webshells/WShell_ASPXSpy.yar" +include "./webshells/WShell_Drupalgeddon2_icos.yar" +include "./webshells/WShell_PHP_Anuna.yar" +include "./webshells/WShell_PHP_in_images.yar" +include "./webshells/WShell_THOR_Webshells.yar" +include "./webshells/Wshell_ChineseSpam.yar" +include "./webshells/Wshell_fire2013.yar" diff --git a/Malicious_Documents/Maldoc_APT10_MenuPass.yar b/maldocs/Maldoc_APT10_MenuPass.yar similarity index 100% rename from Malicious_Documents/Maldoc_APT10_MenuPass.yar rename to maldocs/Maldoc_APT10_MenuPass.yar diff --git a/Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar b/maldocs/Maldoc_APT19_CVE-2017-1099.yar similarity index 100% rename from Malicious_Documents/Maldoc_APT19_CVE-2017-1099.yar rename to maldocs/Maldoc_APT19_CVE-2017-1099.yar diff --git a/Malicious_Documents/Maldoc_APT_OLE_JSRat.yar b/maldocs/Maldoc_APT_OLE_JSRat.yar similarity index 100% rename from Malicious_Documents/Maldoc_APT_OLE_JSRat.yar rename to maldocs/Maldoc_APT_OLE_JSRat.yar diff --git a/Malicious_Documents/Maldoc_CVE-2017-0199.yar b/maldocs/Maldoc_CVE-2017-0199.yar similarity index 100% rename from Malicious_Documents/Maldoc_CVE-2017-0199.yar rename to maldocs/Maldoc_CVE-2017-0199.yar diff --git a/Malicious_Documents/Maldoc_CVE_2017_11882.yar b/maldocs/Maldoc_CVE_2017_11882.yar similarity index 100% rename from Malicious_Documents/Maldoc_CVE_2017_11882.yar rename to maldocs/Maldoc_CVE_2017_11882.yar diff --git a/Malicious_Documents/Maldoc_CVE_2017_8759.yar b/maldocs/Maldoc_CVE_2017_8759.yar similarity index 100% rename from Malicious_Documents/Maldoc_CVE_2017_8759.yar rename to maldocs/Maldoc_CVE_2017_8759.yar diff --git a/Malicious_Documents/Maldoc_Contains_VBE_File.yar b/maldocs/Maldoc_Contains_VBE_File.yar similarity index 100% rename from Malicious_Documents/Maldoc_Contains_VBE_File.yar rename to maldocs/Maldoc_Contains_VBE_File.yar diff --git a/Malicious_Documents/Maldoc_DDE.yar b/maldocs/Maldoc_DDE.yar similarity index 100% rename from Malicious_Documents/Maldoc_DDE.yar rename to maldocs/Maldoc_DDE.yar diff --git a/Malicious_Documents/Maldoc_Dridex.yar b/maldocs/Maldoc_Dridex.yar similarity index 100% rename from Malicious_Documents/Maldoc_Dridex.yar rename to maldocs/Maldoc_Dridex.yar diff --git a/Malicious_Documents/Maldoc_Hidden_PE_file.yar b/maldocs/Maldoc_Hidden_PE_file.yar similarity index 100% rename from Malicious_Documents/Maldoc_Hidden_PE_file.yar rename to maldocs/Maldoc_Hidden_PE_file.yar diff --git a/Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar b/maldocs/Maldoc_MIME_ActiveMime_b64.yar similarity index 100% rename from Malicious_Documents/Maldoc_MIME_ActiveMime_b64.yar rename to maldocs/Maldoc_MIME_ActiveMime_b64.yar diff --git a/Malicious_Documents/Maldoc_PDF.yar b/maldocs/Maldoc_PDF.yar similarity index 100% rename from Malicious_Documents/Maldoc_PDF.yar rename to maldocs/Maldoc_PDF.yar diff --git a/Malicious_Documents/Maldoc_PowerPointMouse.yar b/maldocs/Maldoc_PowerPointMouse.yar similarity index 100% rename from Malicious_Documents/Maldoc_PowerPointMouse.yar rename to maldocs/Maldoc_PowerPointMouse.yar diff --git a/Malicious_Documents/Maldoc_Suspicious_OLE_target.yar b/maldocs/Maldoc_Suspicious_OLE_target.yar similarity index 100% rename from Malicious_Documents/Maldoc_Suspicious_OLE_target.yar rename to maldocs/Maldoc_Suspicious_OLE_target.yar diff --git a/Malicious_Documents/Maldoc_UserForm.yar b/maldocs/Maldoc_UserForm.yar similarity index 100% rename from Malicious_Documents/Maldoc_UserForm.yar rename to maldocs/Maldoc_UserForm.yar diff --git a/Malicious_Documents/Maldoc_VBA_macro_code.yar b/maldocs/Maldoc_VBA_macro_code.yar similarity index 100% rename from Malicious_Documents/Maldoc_VBA_macro_code.yar rename to maldocs/Maldoc_VBA_macro_code.yar diff --git a/Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar b/maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar similarity index 100% rename from Malicious_Documents/Maldoc_Word_2007_XML_Flat_OPC.yar rename to maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar diff --git a/Malicious_Documents/Maldoc_hancitor_dropper b/maldocs/Maldoc_hancitor_dropper similarity index 100% rename from Malicious_Documents/Maldoc_hancitor_dropper rename to maldocs/Maldoc_hancitor_dropper diff --git a/Malicious_Documents/Maldoc_malrtf_ole2link.yar b/maldocs/Maldoc_malrtf_ole2link.yar similarity index 100% rename from Malicious_Documents/Maldoc_malrtf_ole2link.yar rename to maldocs/Maldoc_malrtf_ole2link.yar diff --git a/Malicious_Documents/maldoc_somerules.yar b/maldocs/maldoc_somerules.yar similarity index 100% rename from Malicious_Documents/maldoc_somerules.yar rename to maldocs/maldoc_somerules.yar diff --git a/maldocs_index.yar b/maldocs_index.yar new file mode 100644 index 00000000..8c1b0964 --- /dev/null +++ b/maldocs_index.yar @@ -0,0 +1,23 @@ +/* +Generated by Yara-Rules +On 08-01-2020 +*/ +include "./maldocs/Maldoc_APT10_MenuPass.yar" +include "./maldocs/Maldoc_APT19_CVE-2017-1099.yar" +include "./maldocs/Maldoc_APT_OLE_JSRat.yar" +include "./maldocs/Maldoc_CVE-2017-0199.yar" +include "./maldocs/Maldoc_CVE_2017_11882.yar" +include "./maldocs/Maldoc_CVE_2017_8759.yar" +include "./maldocs/Maldoc_Contains_VBE_File.yar" +include "./maldocs/Maldoc_DDE.yar" +include "./maldocs/Maldoc_Dridex.yar" +include "./maldocs/Maldoc_Hidden_PE_file.yar" +include "./maldocs/Maldoc_MIME_ActiveMime_b64.yar" +include "./maldocs/Maldoc_PDF.yar" +include "./maldocs/Maldoc_PowerPointMouse.yar" +include "./maldocs/Maldoc_Suspicious_OLE_target.yar" +include "./maldocs/Maldoc_UserForm.yar" +include "./maldocs/Maldoc_VBA_macro_code.yar" +include "./maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar" +include "./maldocs/Maldoc_malrtf_ole2link.yar" +include "./maldocs/maldoc_somerules.yar" diff --git a/malware_index.yar b/malware_index.yar index fe7ce997..5ddcc036 100644 --- a/malware_index.yar +++ b/malware_index.yar @@ -1,6 +1,6 @@ /* Generated by Yara-Rules -On 26-11-2019 +On 08-01-2020 */ include "./malware/000_common_rules.yar" include "./malware/APT_APT1.yar" @@ -138,6 +138,7 @@ include "./malware/MALW_Exploit_UAC_Elevators.yar" include "./malware/MALW_Ezcob.yar" include "./malware/MALW_F0xy.yar" include "./malware/MALW_FALLCHILL.yar" +include "./malware/MALW_FUDCrypt.yar" include "./malware/MALW_FakeM.yar" include "./malware/MALW_Fareit.yar" include "./malware/MALW_Favorite.yar" @@ -174,6 +175,7 @@ include "./malware/MALW_LinuxMoose.yar" include "./malware/MALW_LostDoor.yar" include "./malware/MALW_LuaBot.yar" include "./malware/MALW_LuckyCat.yar" +include "./malware/MALW_MSILStealer.yar" include "./malware/MALW_MacControl.yar" include "./malware/MALW_Madness.yar" include "./malware/MALW_Magento_backend.yar" @@ -324,6 +326,7 @@ include "./malware/RANSOM_GPGQwerty.yar" include "./malware/RANSOM_GoldenEye.yar" include "./malware/RANSOM_Locky.yar" include "./malware/RANSOM_MS17-010_Wannacrypt.yar" +include "./malware/RANSOM_Maze.yar" include "./malware/RANSOM_PetrWrap.yar" include "./malware/RANSOM_Petya.yar" include "./malware/RANSOM_SamSam.yar"