SEKOIA_Apt_Unk_Dex_China_Freedom_Trap_Spyware

rule SEKOIA_Apt_Unk_Dex_China_Freedom_Trap_Spyware : FILE
{
	meta:
		description = "Detects China Freedom Trap spyware dex file"
		author = "Sekoia.io"
		id = "3d66b6b8-8397-441a-a337-4a282df39591"
		date = "2022-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_unk_dex_china_freedom_trap_spyware.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "ceb70fce74898ea64ded6880a978441c"
		logic_hash = "f85f78a1a58fa8b2698637f8c540877ea1c5141ff7f74e8c2f2755f5aba5a599"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "INSTALL" base64
		$ = "FAILED" base64
		$ = "TEST" base64
		$ = "ONLY" base64
		$ = "INSTALL" base64
		$ = "INCONSISTENT" base64
		$ = "CERTIFICATES" base64
		$ = "Network country iso:" base64
		$ = "Network operator name:" base64
		$ = "SIM operator name:" base64
		$ = "SIM country iso:" base64
		$ = "SIM state:" base64
		$ = "PIN REQUIRED" base64
		$ = "PUK REQUIRED" base64

	condition:
		uint32be( 0 ) == 0x6465780A and filesize < 100KB and 4 of them
}