Volatility3 MCP Server

rule android_tempting_cedar_spyware { meta: Author = "@X0RC1SM" Date = "2018-03-06" Reference = "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware" strings: $PK_HEADER = {50 4B 03 04} $MANIFEST = "META-INF/MANIFEST.MF" $DEX_FILE = "classes.dex" $string = "rsdroid.crt" condition: $PK_HEADER in (0..4) and $MANIFEST and $DEX_FILE and any of ($string*) }