Règles YARA avec le tag EVILBAMBOO

Detects the JMASK profiling script in its minified // obfuscated format.

Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication.

Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2.

Detects the JMASK profiling script in an obfuscated format using a string array and an offset.