Volatility3 MCP Server

/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. */ import "androguard" rule spyAgent { meta: description = "This rule detects arabian spyware which records call and gathers user information which is later sent to a remote c&c" sample = "7cbf61fbb31c26530cafb46282f5c90bc10fe5c724442b8d1a0b87a8125204cb" reference = "https://blogs.mcafee.com/mcafee-labs/android-spyware-targets-security-job-seekers-in-saudi-arabia/" author = "@koodous_project" strings: $phone = "0597794205" $caption = "New victim arrived" $cc = "http://ksa-sef.com/Hack%20Mobaile/ADDNewSMS.php" $cc_alt = "http://ksa-sef.com/Hack%20Mobaile/AddAllLogCall.php" $cc_alt2= "http://ksa-sef.com/Hack%20Mobaile/addScreenShot.php" $cc_alt3= "http://ksa-sef.com/Hack%20Mobaile/ADDSMS.php" $cc_alt4 = "http://ksa-sef.com/Hack%20Mobaile/ADDVCF.php" $cc_alt5 = "http://ksa-sef.com/Hack%20Mobaile/ADDIMSI.php" $cc_alt6 = "http://ksa-sef.com/Hack%20Mobaile/ADDHISTORYINTERNET.php" $cc_alt7 = "http://ksa-sef.com/Hack%20Mobaile/addInconingLogs.php" condition: androguard.url(/ksa-sef\.com/) or ($phone and $caption) or ($cc and $cc_alt and $cc_alt2 and $cc_alt3 and $cc_alt4 and $cc_alt5 and $cc_alt6 and $cc_alt7) }