SEKOIA_Trojan_Android_Brata

rule SEKOIA_Trojan_Android_Brata : FILE
{
	meta:
		description = "Detect samples of the Android banking trojan BRATA"
		author = "Sekoia.io"
		id = "fde9b82e-c677-44ed-b512-b225a3aba201"
		date = "2022-01-27"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/trojan_android_brata.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "0c94e5e0c01d4fa9bf28603787029938a3159f468dd3876e7d25646e93dd68b8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$goo0 = "Google Play services error"
		$goo1 = "Error de Serveis de Google Play"
		$goo2 = "Fehler bei Zugriff auf Google Play-Dienste"
		$goo3 = "Erro nos servizos de Google Play"
		$goo4 = "Fout met Google Play-services"
		$goo5 = "Virhe Google Play -palveluissa"
		$goo6 = "Erro do Google Play Services"
		$goo7 = "Error de Google Play Services"
		$res0 = "res/xml/device_admin.xml"
		$res1 = "res/xml/windowchangedetectingservice.xml"
		$res2 = "res/xml-v22/windowchangedetectingservice.xml"

	condition:
		uint32be( 0 ) == 0x504B0304 and filesize > 2MB and filesize < 6MB and 7 of ( $goo* ) and 2 of ( $res* )
}