Skip to content
yararules.org
Menu

YARA rules tagged EVILBAMBOO

4 rules carry the tag “EVILBAMBOO”.

  • VOLEXITY_Apt_Delivery_Web_Js_Jmask

    Detects the JMASK profiling script in its minified // obfuscated format.

    APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-15
  • VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate

    Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication.

    APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-01
  • VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23

    Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2.

    APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-25
  • VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant

    Detects the JMASK profiling script in an obfuscated format using a string array and an offset.

    APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-27