Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
28
data/ioc/yara/malware_families/ezcob.yara
Normal file
28
data/ioc/yara/malware_families/ezcob.yara
Normal file
@@ -0,0 +1,28 @@
|
||||
private rule EzcobStrings : Ezcob Family
|
||||
{
|
||||
meta:
|
||||
description = "Ezcob Identifying Strings"
|
||||
author = "Seth Hardy"
|
||||
last_modified = "2014-06-23"
|
||||
|
||||
strings:
|
||||
$ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
|
||||
$ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
|
||||
$ = "Ezcob" wide ascii
|
||||
$ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
|
||||
$ = "20110113144935"
|
||||
|
||||
condition:
|
||||
any of them
|
||||
}
|
||||
|
||||
rule Ezcob : Family
|
||||
{
|
||||
meta:
|
||||
description = "Ezcob"
|
||||
author = "Seth Hardy"
|
||||
last_modified = "2014-06-23"
|
||||
|
||||
condition:
|
||||
EzcobStrings
|
||||
}
|
||||
Reference in New Issue
Block a user