deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: towelhacking_cromosome
Repository: Yara-Rules/rules
Detects: From cromosome.py
Author: Fernando Denis Ramirez https://twitter.com/fdrg21
Reference: https://koodous.com/

Pattern signatures:
$cromosome_a = "res/xml/device_admin_data.xml]"
	  	$cromosome_b = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACABAMAAAAxEHz4AAAAGFBMVEVMaXGUwUWTwEaTwEaTwEaTwEaVwUWTwEalNfqIAAAAB3RSTlMALozOuetYmPN8xgAAAbFJREFUeF7t2E9L+zAcx/FP1i3n7PfHXauivW7K3HWAY1dFoNci2l61Lvs8fUOxZYW22RdBBub1AN4kX7KQDqcvCILgDC0aUlcGhzaQ+j/HAb2HlC5buTXEEoMGlgZikzkAledTAKM95HSJPxs6T9eYrSGHZMMvuyXkoLZs2AxyCQ98GEi9sqWEkGYb1/INMGUtFW9iRDLWdWGhtuQCEgW5a+ZIgwn5AQFVjQ0zViwQkYwFgYjVCorDFfBdtgMyU80MkFC2h5SOXfGLXbIqyg9B2xzHGrODZAgzdioFM+y0E5zjThbHurzthl9Bb24M8HLfzQCXT+cYsiX3QMJuBn9Jazz3CLOBwIrko+8IzvsDmk7pO4Lv/YExPT/rxBOI6NjTCIRACIRACITA2BeY0XnoD4x8D5WITtwfUKnnraVScof+AArfk/cfbTwU0CveYdDUYCgANYXPYKBx+oEQKL772I7YaS/+cG+zMY6m8vyFDnOnqpV5nkFkVI+tvmWAXxkIgRDQdGxzO7xBSqX1B9qEzhpiBcmHei3WQEyn9d9fr+QCcji7yFDB8zV+QhAEQfAJcs5K2TAQqxAAAAAASUVORK5CYII="

		$cromosome_c = "device_admin_desc"
		$cromosome_d = "PillagedActivity"
		$cromosome_e = "EpigraphyService"

Detection condition:
($cromosome_a and $cromosome_b) or ($cromosome_c and $cromosome_d and $cromosome_e)

Full rule:
rule towelhacking_cromosome
{
	meta:
		author = "Fernando Denis Ramirez https://twitter.com/fdrg21"
		reference = "https://koodous.com/"
		description = "From cromosome.py"

	strings:
		$cromosome_a = "res/xml/device_admin_data.xml]"
	  	$cromosome_b = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACABAMAAAAxEHz4AAAAGFBMVEVMaXGUwUWTwEaTwEaTwEaTwEaVwUWTwEalNfqIAAAAB3RSTlMALozOuetYmPN8xgAAAbFJREFUeF7t2E9L+zAcx/FP1i3n7PfHXauivW7K3HWAY1dFoNci2l61Lvs8fUOxZYW22RdBBub1AN4kX7KQDqcvCILgDC0aUlcGhzaQ+j/HAb2HlC5buTXEEoMGlgZikzkAledTAKM95HSJPxs6T9eYrSGHZMMvuyXkoLZs2AxyCQ98GEi9sqWEkGYb1/INMGUtFW9iRDLWdWGhtuQCEgW5a+ZIgwn5AQFVjQ0zViwQkYwFgYjVCorDFfBdtgMyU80MkFC2h5SOXfGLXbIqyg9B2xzHGrODZAgzdioFM+y0E5zjThbHurzthl9Bb24M8HLfzQCXT+cYsiX3QMJuBn9Jazz3CLOBwIrko+8IzvsDmk7pO4Lv/YExPT/rxBOI6NjTCIRACIRACITA2BeY0XnoD4x8D5WITtwfUKnnraVScof+AArfk/cfbTwU0CveYdDUYCgANYXPYKBx+oEQKL772I7YaS/+cG+zMY6m8vyFDnOnqpV5nkFkVI+tvmWAXxkIgRDQdGxzO7xBSqX1B9qEzhpiBcmHei3WQEyn9d9fr+QCcji7yFDB8zV+QhAEQfAJcs5K2TAQqxAAAAAASUVORK5CYII="

		$cromosome_c = "device_admin_desc"
		$cromosome_d = "PillagedActivity"
		$cromosome_e = "EpigraphyService"

	condition:
		($cromosome_a and $cromosome_b) or ($cromosome_c and $cromosome_d and $cromosome_e)
		
}
YARA Detection Rule: fake_facebook
Repository: Yara-Rules/rules
Author: https://twitter.com/Diviei
Reference: https://koodous.com/

Detection condition:
androguard.app_name("Facebook")
		and not androguard.certificate.sha1("A0E980408030C669BCEB38FEFEC9527BE6C3DDD0")

Full rule:
rule fake_facebook: fake android
{
  meta:
		  author = "https://twitter.com/Diviei"
		  reference = "https://koodous.com/"
	condition:
		androguard.app_name("Facebook")
		and not androguard.certificate.sha1("A0E980408030C669BCEB38FEFEC9527BE6C3DDD0")
}
YARA Detection Rule: fake_facebook_2
Repository: Yara-Rules/rules
Detects: Detects fake facebook applications
Author: https://twitter.com/plutec_net
Reference: https://koodous.com/

Detection condition:
androguard.app_name("Facebook") and
		not androguard.package_name(/com.facebook.katana/) and 
		not androguard.certificate.issuer(/O=Facebook Mobile/)

Full rule:
rule fake_facebook_2 : fake android
{
	meta:
		author = "https://twitter.com/plutec_net"
		reference = "https://koodous.com/"
		description = "Detects fake facebook applications"
		hash_0 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
		hash_1 = "c1264c[PII_REDACTED]61409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
		hash_2 = "70d5cc909d[PII_REDACTED]a54b44f83bd194cbdd2d99354d52cd868b334fb5f3de"
		hash_3 = "38e757abd5e015e3c3690ea0fdc2ff1e04b716651645a8c4ca6a63185856fe29"
		hash_4 = "ba0b8fe37b4874656ad129dd4d96fdec181e2c[PII_REDACTED]241b0449bb4ab84f"
		hash_5 = "7be33c2d27121968d2f7081ae2b04965238a3c15c7aae62d006f629d64e0b58e"
		hash_6 = "c1264c[PII_REDACTED]61409eb02570fd49bec91c88569d39062e13c0c8ae0e1806"
		hash_7 = "7345c3124891b34607a07e93c8ab6dcbbf513e24e936c3710434b085981b815a"
		
	condition:
		androguard.app_name("Facebook") and
		not androguard.package_name(/com.facebook.katana/) and 
		not androguard.certificate.issuer(/O=Facebook Mobile/)	
}
YARA Detection Rule: fake_instagram
Repository: Yara-Rules/rules
Author: https://twitter.com/Diviei
Reference: https://koodous.com/

Detection condition:
androguard.app_name("Instagram")
		and not androguard.certificate.sha1("76D72C35164513A4A7EBA098ACCB2B22D2229CBE")

Full rule:
rule fake_instagram: fake android
{
  meta:
		  author = "https://twitter.com/Diviei"
		  reference = "https://koodous.com/"
	condition:
		androguard.app_name("Instagram")
		and not androguard.certificate.sha1("76D72C35164513A4A7EBA098ACCB2B22D2229CBE")
}
YARA Detection Rule: fake_king_games
Repository: Yara-Rules/rules

Detection condition:
(androguard.app_name("AlphaBetty Saga")
		or androguard.app_name("Candy Crush Soda Saga")
		or androguard.app_name("Candy Crush Saga")
		or androguard.app_name("Farm Heroes Saga")
		or androguard.app_name("Pet Rescue Saga")
		or androguard.app_name("Bubble Witch 2 Saga")
		or androguard.app_name("Sc

Full rule:
rule fake_king_games: fake android
{
	condition:
		(androguard.app_name("AlphaBetty Saga")
		or androguard.app_name("Candy Crush Soda Saga")
		or androguard.app_name("Candy Crush Saga")
		or androguard.app_name("Farm Heroes Saga")
		or androguard.app_name("Pet Rescue Saga")
		or androguard.app_name("Bubble Witch 2 Saga")
		or androguard.app_name("Scrubby Dubby Saga")
		or androguard.app_name("Diamond Digger Saga")
		or androguard.app_name("Papa Pear Saga")
		or androguard.app_name("Pyramid Solitaire Saga")
		or androguard.app_name("Bubble Witch Saga")
		or androguard.app_name("King Challenge"))
		and not androguard.certificate.sha1("9E93B3336C767C3ABA6FCC4DEADA9F179EE4A05B")
}
YARA Detection Rule: fake_market
Repository: Yara-Rules/rules
Author: https://twitter.com/plutec_net
Reference: https://koodous.com/

Detection condition:
androguard.package_name("com.minitorrent.kimill")

Full rule:
rule fake_market: fake android
{
  meta:
		author = "https://twitter.com/plutec_net"
		reference = "https://koodous.com/"

	condition:
		androguard.package_name("com.minitorrent.kimill") 
}
YARA Detection Rule: fake_minecraft
Repository: Yara-Rules/rules
Author: https://twitter.com/plutec_net
Reference: https://koodous.com/

Detection condition:
( androguard.app_name("Minecraft: Pocket Edition") or 
			androguard.app_name("Minecraft - Pocket Edition") )
		and not androguard.package_name("com.mojang.minecraftpe")

Full rule:
rule fake_minecraft: fake android
{
  meta:
		author = "https://twitter.com/plutec_net"
		reference = "https://koodous.com/"
	condition:
		( androguard.app_name("Minecraft: Pocket Edition") or 
			androguard.app_name("Minecraft - Pocket Edition") )
		and not androguard.package_name("com.mojang.minecraftpe")
}
YARA Detection Rule: fake_whatsapp
Repository: Yara-Rules/rules
Author: https://twitter.com/Diviei
Reference: https://koodous.com/

Detection condition:
androguard.app_name("WhatsApp") and
		not androguard.certificate.sha1("38A0F7D505FE18FEC64FBF343ECAAAF310DBD799")

Full rule:
rule fake_whatsapp: fake android
{
  meta:
		  author = "https://twitter.com/Diviei"
		  reference = "https://koodous.com/"
	condition:
		androguard.app_name("WhatsApp") and
		not androguard.certificate.sha1("38A0F7D505FE18FEC64FBF343ECAAAF310DBD799")
}
YARA Detection Rule: coudw
Repository: Yara-Rules/rules
Malware family: coudw

Detection condition:
androguard.url(/s\.cloudsota\.com/)

Full rule:
rule coudw: amtrckr
{
	meta:
		family = "coudw"

	condition:
		androguard.url(/s\.cloudsota\.com/)
}
YARA Detection Rule: z3core
Repository: Yara-Rules/rules
Malware family: z3core

Detection condition:
androguard.url(/lexsmilefux\.link/)

Full rule:
rule z3core: amtrckr
{
	meta:
		family = "z3core"

	condition:
		androguard.url(/lexsmilefux\.link/)
}
YARA Detection Rule: gtalocker
Repository: Yara-Rules/rules
Malware family: gtalocker

Detection condition:
androguard.url(/niktoegoneyznaet0kol\.pw/)

Full rule:
rule gtalocker: amtrckr
{
	meta:
		family = "gtalocker"

	condition:
		androguard.url(/niktoegoneyznaet0kol\.pw/)
}
YARA Detection Rule: marcher
Repository: Yara-Rules/rules
Malware family: marcher

Detection condition:
androguard.url(/104\.238\.176\.9/) or 
		androguard.url(/golioni\.tk/) or 
		androguard.url(/poloclubs\.tk/) or 
		androguard.url(/thejcb\.ru/) or 
		androguard.url(/shgt\.tk/) or 
		androguard.url(/pologt\.tk/) or 
		androguard.url(/108\.61\.211\.219/) or 
		androguard.url(/vipcoon\.com/) or 
		and

Full rule:
rule marcher: amtrckr
{
	meta:
		family = "marcher"

	condition:
		androguard.url(/104\.238\.176\.9/) or 
		androguard.url(/golioni\.tk/) or 
		androguard.url(/poloclubs\.tk/) or 
		androguard.url(/thejcb\.ru/) or 
		androguard.url(/shgt\.tk/) or 
		androguard.url(/pologt\.tk/) or 
		androguard.url(/108\.61\.211\.219/) or 
		androguard.url(/vipcoon\.com/) or 
		androguard.url(/firenzonne\.com/) or 
		androguard.url(/extgta\.tk/) or 
		androguard.url(/manaclubs\.tk/) or 
		androguard.url(/151\.248\.126\.183/) or 
		androguard.url(/188\.209\.49\.198/)
}
YARA Detection Rule: lenovo_reaper
Repository: Yara-Rules/rules
Malware family: lenovo_reaper

Detection condition:
androguard.url(/uefsr\.lenovomm\.com/)

Full rule:
rule lenovo_reaper: amtrckr
{
	meta:
		family = "lenovo_reaper"

	condition:
		androguard.url(/uefsr\.lenovomm\.com/)
}
YARA Detection Rule: unknown_1
Repository: Yara-Rules/rules
Malware family: unknown

Detection condition:
androguard.url(/222\.76\.213\.20/) or 
		androguard.url(/103\.38\.42\.236/) or 
		androguard.url(/103\.243\.181\.41/) or 
		androguard.url(/123\.1\.157\.4/)

Full rule:
rule unknown_1: amtrckr
{
	meta:
		family = "unknown"

	condition:
		androguard.url(/222\.76\.213\.20/) or 
		androguard.url(/103\.38\.42\.236/) or 
		androguard.url(/103\.243\.181\.41/) or 
		androguard.url(/123\.1\.157\.4/)
}
YARA Detection Rule: jagonca
Repository: Yara-Rules/rules
Malware family: jagonca

Detection condition:
androguard.url(/abra-k0dabra\.com/) or 
		androguard.url(/heibe-titten\.com/)

Full rule:
rule jagonca: amtrckr
{
	meta:
		family = "jagonca"

	condition:
		androguard.url(/abra-k0dabra\.com/) or 
		androguard.url(/heibe-titten\.com/)
}
YARA Detection Rule: thoughtcrime
Repository: Yara-Rules/rules
Malware family: thoughtcrime

Detection condition:
androguard.url(/losbalonazos\.com/) or 
		androguard.url(/www\.oguhtell\.ch/) or 
		androguard.url(/szaivert-numis\.at/) or 
		androguard.url(/edda-mally\.at/) or 
		androguard.url(/clubk-ginza\.net/)

Full rule:
rule thoughtcrime: amtrckr
{
	meta:
		family = "thoughtcrime"

	condition:
		androguard.url(/losbalonazos\.com/) or 
		androguard.url(/www\.oguhtell\.ch/) or 
		androguard.url(/szaivert-numis\.at/) or 
		androguard.url(/edda-mally\.at/) or 
		androguard.url(/clubk-ginza\.net/)
}
YARA Detection Rule: slocker
Repository: Yara-Rules/rules
Malware family: slocker

Detection condition:
androguard.url(/aerofigg\.org/)

Full rule:
rule slocker: amtrckr
{
	meta:
		family = "slocker"

	condition:
		androguard.url(/aerofigg\.org/)
}
YARA Detection Rule: infostealer
Repository: Yara-Rules/rules
Malware family: infostealer

Detection condition:
androguard.url(/koko02\.ru/)

Full rule:
rule infostealer: amtrckr
{
	meta:
		family = "infostealer"

	condition:
		androguard.url(/koko02\.ru/)
}
YARA Detection Rule: pornlocker
Repository: Yara-Rules/rules
Malware family: pornlocker

Detection condition:
androguard.url(/playmarketcheck\.com/) or 
		androguard.url(/pornigy\.biz/)

Full rule:
rule pornlocker: amtrckr
{
	meta:
		family = "pornlocker"

	condition:
		androguard.url(/playmarketcheck\.com/) or 
		androguard.url(/pornigy\.biz/)
}
YARA Detection Rule: droidian
Repository: Yara-Rules/rules
Malware family: droidian

Detection condition:
androguard.url(/z0\.tkurd\.net/)

Full rule:
rule droidian: amtrckr
{
	meta:
		family = "droidian"

	condition:
		androguard.url(/z0\.tkurd\.net/)
}
YARA Detection Rule: androrat
Repository: Yara-Rules/rules
Malware family: androrat

Detection condition:
androguard.url(/toyman6699\.no-ip\.info/) or 
		androguard.url(/aerror\.no-ip\.biz/) or 
		androguard.url(/androrat\.servegame\.com/) or 
		androguard.url(/197\.35\.22\.37/) or 
		androguard.url(/androrat1\.no-ip\.biz/) or 
		androguard.url(/151\.72\.17\.61/) or 
		androguard.url(/qwerty1212\.ddns\.

Full rule:
rule androrat: amtrckr
{
	meta:
		family = "androrat"

	condition:
		androguard.url(/toyman6699\.no-ip\.info/) or 
		androguard.url(/aerror\.no-ip\.biz/) or 
		androguard.url(/androrat\.servegame\.com/) or 
		androguard.url(/197\.35\.22\.37/) or 
		androguard.url(/androrat1\.no-ip\.biz/) or 
		androguard.url(/151\.72\.17\.61/) or 
		androguard.url(/qwerty1212\.ddns\.net/) or 
		androguard.url(/recycled\.no-ip\.org/) or 
		androguard.url(/gert44\.duckdns\.org/) or 
		androguard.url(/78\.169\.63\.163/) or 
		androguard.url(/hash0r\.no-ip\.biz/) or 
		androguard.url(/alpheron\.duckdns\.org/) or 
		androguard.url(/cricbot\.no-ip\.info/) or 
		androguard.url(/hazhar77\.no-ip\.biz/) or 
		androguard.url(/aleem\.top7@gmail\.com/) or 
		androguard.url(/murryapplicazione\.no-ip\.org/) or 
		androguard.url(/helloandroid\.no-ip\.org/) or 
		androguard.url(/79\.170\.54\.154/) or 
		androguard.url(/mohammad2002\.no-ip\.biz/) or 
		androguard.url(/1756mostacc\.ddns\.net/) or 
		androguard.url(/shakaky\.ddns\.net/) or 
		androguard.url(/asadhashmi\.ddns\.net/) or 
		androguard.url(/174\.127\.99\.232/) or 
		androguard.url(/109\.95\.56\.22/) or 
		androguard.url(/dagohack\.no-ip\.me/) or 
		androguard.url(/pruebasernesto\.ddns\.net/) or 
		androguard.url(/zola123\.no-ip\.biz/) or 
		androguard.url(/mikestar\.no-ip\.biz/) or 
		androguard.url(/132\.72\.81\.164/) or 
		androguard.url(/zongkahani\.no-ip\.biz/) or 
		androguard.url(/florian-pc\.ksueyuj0mtxpt6gn\.myfritz\.net/) or 
		androguard.url(/kontolanime\.no-ip\.biz/) or 
		androguard.url(/41\.143\.69\.230/) or 
		androguard.url(/gentel901\.no-ip\.org/) or 
		androguard.url(/anonimousdre180\.ddns\.net/) or 
		androguard.url(/sajadianh\.ddns\.net/) or 
		androguard.url(/195\.2\.239\.147/) or 
		androguard.url(/vipmustafa\.no-ip\.info/) or 
		androguard.url(/alihoseini\.no-ip\.biz/) or 
		androguard.url(/aymen1852\.ddns\.net/) or 
		androguard.url(/danialmostafaei\.no-ip\.biz/) or 
		androguard.url(/100\.1\.254\.38/) or 
		androgua
YARA Detection Rule: sandrorat
Repository: Yara-Rules/rules
Malware family: sandrorat

Detection condition:
androguard.url(/tak\.no-ip\.info/) or 
		androguard.url(/maskaralama\.ddns\.net/) or 
		androguard.url(/sondres1\.ddns\.net/) or 
		androguard.url(/toyman6699\.no-ip\.info/) or 
		androguard.url(/appmarket\.servehttp\.com/) or 
		androguard.url(/31\.210\.117\.132/) or 
		androguard.url(/freeann\.syt

Full rule:
rule sandrorat: amtrckr
{
	meta:
		family = "sandrorat"

	condition:
		androguard.url(/tak\.no-ip\.info/) or 
		androguard.url(/maskaralama\.ddns\.net/) or 
		androguard.url(/sondres1\.ddns\.net/) or 
		androguard.url(/toyman6699\.no-ip\.info/) or 
		androguard.url(/appmarket\.servehttp\.com/) or 
		androguard.url(/31\.210\.117\.132/) or 
		androguard.url(/freeann\.sytes\.net/) or 
		androguard.url(/changyu231\.ddns\.net/) or 
		androguard.url(/mohammed22468\.no-ip\.biz/) or 
		androguard.url(/oneriakosa\.ddns\.net/) or 
		androguard.url(/46\.186\.155\.219/) or 
		androguard.url(/jockerhackerxnxx\.ddns\.net/) or 
		androguard.url(/41\.251\.251\.7/) or 
		androguard.url(/megalol\.chickenkiller\.com/) or 
		androguard.url(/188\.166\.76\.144/) or 
		androguard.url(/injectman\.no-ip\.info/) or 
		androguard.url(/aasxzxdsc12324\.no-ip\.biz/) or 
		androguard.url(/magemankoktelam\.ddns\.net/) or 
		androguard.url(/alfazaai99\.ddns\.net/) or 
		androguard.url(/dantehack\.zapto\.org/) or 
		androguard.url(/droidjack1\.sytes\.net/) or 
		androguard.url(/th3expert\.3utilities\.com/) or 
		androguard.url(/mohamed46565656\.no-ip\.biz/) or 
		androguard.url(/chrisfo\.no-ip\.org/) or 
		androguard.url(/hazhar77\.no-ip\.biz/) or 
		androguard.url(/31\.146\.202\.169/) or 
		androguard.url(/njesra\.ddns\.net/) or 
		androguard.url(/yorkiepet\.ddns\.net/) or 
		androguard.url(/mrgnet\.ddns\.net/) or 
		androguard.url(/droy\.zapto\.org/) or 
		androguard.url(/93\.104\.213\.217/) or 
		androguard.url(/amarok58\.no-ip\.biz/) or 
		androguard.url(/server4update\.serveftp\.com/) or 
		androguard.url(/zaliminxx\.duckdns\.org/) or 
		androguard.url(/anonymo9s\.ddns\.net/) or 
		androguard.url(/htmp\.sytes\.net/) or 
		androguard.url(/khalid-2016\.noip\.me/) or 
		androguard.url(/mahasiswa\.no-ip\.biz/) or 
		androguard.url(/mamal9921\.ddns\.net/) or 
		androguard.url(/kaddress\.ddns\.net/) or 
		androguard.url(/sharmayash\.no-ip\.biz/) or 
		androguard.url(/RATForAndroid\.ddns\.net/) or
YARA Detection Rule: ibanking
Repository: Yara-Rules/rules
Malware family: ibanking

Detection condition:
androguard.url(/www\.irmihan\.ir/) or 
		androguard.url(/emberaer\.com/)

Full rule:
rule ibanking: amtrckr
{
	meta:
		family = "ibanking"

	condition:
		androguard.url(/www\.irmihan\.ir/) or 
		androguard.url(/emberaer\.com/)
}
YARA Detection Rule: ransomware
Repository: Yara-Rules/rules
Detects: Ransomware
Author: Fernando Denis https://twitter.com/fdrg21
Reference: https://koodous.com/

Pattern signatures:
$a =  {6e 64 20 79 6f 75 72 27 73 20 64 65 76 69 63 65 20 77 69 6c 6c 20 72 65 62 6f 6f 74 20 61 6e 64}
		$b = "ADD_DEVICE_ADMI"

Detection condition:
$a and $b

Full rule:
rule ransomware : svpeng android
{
	meta:
		author = "Fernando Denis https://twitter.com/fdrg21"
		reference = "https://koodous.com/"
		description = "Ransomware"
		in_the_wild = true

	strings:
		$a =  {6e 64 20 79 6f 75 72 27 73 20 64 65 76 69 63 65 20 77 69 6c 6c 20 72 65 62 6f 6f 74 20 61 6e 64}
		$b = "ADD_DEVICE_ADMI"

	condition:
		$a and $b
}
YARA Detection Rule: Ransomware
Repository: Yara-Rules/rules
Detects: Ransomware Test 2
Author: Fernando Denis https://twitter.com/fdrg21
Reference: https://koodous.com/

Pattern signatures:
$strings_a = "!2,.B99^GGD&R-"
		$strings_b = "[PII_REDACTED][PII_REDACTED]Q^SAAWA"
		$strings_c = "t[PII_REDACTED]229222Q^SAAWA"

Detection condition:
any of ($strings_*)

Full rule:
rule Ransomware : banker android
{
	meta:
		author = "Fernando Denis https://twitter.com/fdrg21"
		reference = "https://koodous.com/"
		description = "Ransomware Test 2"
		thread_level = 3
		in_the_wild = true

	strings:

		$strings_a = "!2,.B99^GGD&R-"
		$strings_b = "[PII_REDACTED][PII_REDACTED]Q^SAAWA"
		$strings_c = "t[PII_REDACTED]229222Q^SAAWA"

	

	condition:
		any of ($strings_*)
}
YARA Detection Rule: koler_domains
Repository: Yara-Rules/rules
Detects: Old Koler.A domains examples
Author: https://twitter.com/jsmesa
Reference: https://koodous.com/

Detection condition:
cuckoo.network.dns_lookup(/police-scan-mobile.com/) or
		cuckoo.network.dns_lookup(/police-secure-mobile.com/) or
		cuckoo.network.dns_lookup(/mobile-policeblock.com/) or
		cuckoo.network.dns_lookup(/police-strong-mobile.com/) or
		cuckoo.network.dns_lookup(/video-porno-gratuit.eu/) or
		cuckoo.netw

Full rule:
rule koler_domains : android
{
	meta:
 		author = "https://twitter.com/jsmesa"
		reference = "https://koodous.com/"
		description = "Old Koler.A domains examples"
		sample = "2e1ca3a9f46748e0e4aebdea1afe84f1015e3e7ce667a91e4cfabd0db8557cbf"

	condition:
		cuckoo.network.dns_lookup(/police-scan-mobile.com/) or
		cuckoo.network.dns_lookup(/police-secure-mobile.com/) or
		cuckoo.network.dns_lookup(/mobile-policeblock.com/) or
		cuckoo.network.dns_lookup(/police-strong-mobile.com/) or
		cuckoo.network.dns_lookup(/video-porno-gratuit.eu/) or
		cuckoo.network.dns_lookup(/video-sartex.us/) or 
		cuckoo.network.dns_lookup(/policemobile.biz/)
}
YARA Detection Rule: koler_builds
Repository: Yara-Rules/rules
Detects: Koler.A builds
Author: https://twitter.com/jsmesa
Reference: https://koodous.com/

Pattern signatures:
$0 = "buildid"
		$a = "DCEF055EEE3F76CABB27B3BD7233F6E3"
		$b = "C143D55D996634D1B[PII_REDACTED]42474"

Detection condition:
$0 and ($a or $b)

Full rule:
rule koler_builds : android
{
	meta:
		author = "https://twitter.com/jsmesa"
		reference = "https://koodous.com/"
		description = "Koler.A builds"

	strings:
		$0 = "buildid"
		$a = "DCEF055EEE3F76CABB27B3BD7233F6E3"
		$b = "C143D55D996634D1B[PII_REDACTED]42474"
		
	condition:
		$0 and ($a or $b)
		
}
YARA Detection Rule: koler_class
Repository: Yara-Rules/rules
Detects: Koler.A class
Author: https://twitter.com/jsmesa
Reference: https://koodous.com/

Pattern signatures:
$0 = "FIND_VALID_DOMAIN"
		$a = "6589y459"

Detection condition:
$0 and $a

Full rule:
rule koler_class : android
{
	meta:
		author = "https://twitter.com/jsmesa"
		reference = "https://koodous.com/"
		description = "Koler.A class"

	strings:
		$0 = "FIND_VALID_DOMAIN"
		$a = "6589y459"
		
	condition:
		$0 and $a
		
}
YARA Detection Rule: koler_D
Repository: Yara-Rules/rules
Detects: Koler.D class
Author: https://twitter.com/jsmesa
Reference: https://koodous.com/

Pattern signatures:
$0 = "ZActivity"
		$a = "Lcom/android/zics/ZRuntimeInterface"

Detection condition:
($0 and $a)

Full rule:
rule koler_D : android
{
	meta:
		author = "https://twitter.com/jsmesa"
		reference = "https://koodous.com/"
		description = "Koler.D class"

	strings:
		$0 = "ZActivity"
		$a = "Lcom/android/zics/ZRuntimeInterface"
		
	condition:
		($0 and $a)
		
}
YARA Detection Rule: smsfraud1
Repository: Yara-Rules/rules
Detects: This rule detects a kind of SMSFraud trojan
Author: Antonio Sánchez https://twitter.com/plutec_net
Reference: https://koodous.com/

Pattern signatures:
$a = "E!QQAZXS"
        $b = "__exidx_end"
        $c = "res/layout/notify_apkinstall.xmlPK"

Detection condition:
all of them

Full rule:
rule smsfraud1 : android
{
    meta:
        author = "Antonio Sánchez https://twitter.com/plutec_net"
        reference = "https://koodous.com/"
        description = "This rule detects a kind of SMSFraud trojan"
        sample = "265890c3765d9698091e347f5fcdcf1aba24c[PII_REDACTED]20cc62011a5423df2"
        sample2 = "112b61c778d014088b89ace5e561eb75631a35b21c64254e32d506379afc344c"

    strings:
        $a = "E!QQAZXS"
        $b = "__exidx_end"
        $c = "res/layout/notify_apkinstall.xmlPK"

    condition:
    all of them
        
}
YARA Detection Rule: smsfraud2
Repository: Yara-Rules/rules
Author: Antonio Sánchez https://twitter.com/plutec_net
Reference: https://koodous.com/

Pattern signatures:
$a = "pluginSMS_decrypt"
        $b = "pluginSMS_encrypt"
        $c = "__dso_handle"
        $d = "lib/armeabi/libmylib.soUT"
        $e = "]Diok\"3|"

Detection condition:
all of them

Full rule:
rule smsfraud2 : android {
    meta:
        author = "Antonio Sánchez https://twitter.com/plutec_net"
        reference = "https://koodous.com/"
        sample = "0200a454f0de2574db0b58421ea83f0f340bc6e0b0a051fe943fdfc55fea305b"
        sample2 = "bff3881a8096398b2ded8717b6ce1b86a823e307c919916ab792a13f2f5333b6"

    strings:
        $a = "pluginSMS_decrypt"
        $b = "pluginSMS_encrypt"
        $c = "__dso_handle"
        $d = "lib/armeabi/libmylib.soUT"
        $e = "]Diok\"3|"
    condition:
        all of them
}
YARA Detection Rule: Android_Copy9
Repository: Yara-Rules/rules
Detects: This rule try to detect commercial spyware from Copy9
Author: Jacob Soo Lead Re

Detection condition:
androguard.service(/com.ispyoo/i) and
        androguard.receiver(/com.ispyoo/i)

Full rule:
rule Android_Copy9
{
	meta:
		author = "Jacob Soo Lead Re"
		date = "06-June-2016"
		description = "This rule try to detect commercial spyware from Copy9"
		source = "http://copy9.com/"

	condition:
		androguard.service(/com.ispyoo/i) and
        androguard.receiver(/com.ispyoo/i)
}