DITEKSHEN_MALWARE_Osx_Genieo

rule DITEKSHEN_MALWARE_Osx_Genieo : FILE
{
	meta:
		description = "Detects LinqurySearch/Genieo adware"
		author = "ditekSHen"
		id = "ac44eefd-bf1c-5d4b-bcd4-9a5d394ac1d3"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3094-L3112"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "951dc8539435a52d9eea00b3fdaf98cf618c03867066819f2f9244165e57c675"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Osx.Trojan.Genieo"

	strings:
		$s1 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
		$s2 = "U1QQFXAfCxAfRUNCH1JZXh9" ascii
		$s3 = "XVFTQ1VRQlNYH" ascii
		$s4 = "dF9HXlxfUVQQVUJCX0IQHRB" ascii
		$s5 = "Value:forHTTPHeaderField:" ascii
		$s6 = "postContent:::" fullword ascii
		$s7 = "postLog:" fullword ascii
		$s8 = "initWithBase64EncodedString:options:" fullword ascii
		$s9 = "do shell script \"%@\" with administrator privileges" fullword ascii
		$s10 = /LinqurySearch-[a-f0-9]{40,}/

	condition:
		uint16( 0 ) == 0xfacf and 6 of them
}