-
Notifications
You must be signed in to change notification settings - Fork 35
/
PK_AXA_fun.yar
30 lines (28 loc) · 854 Bytes
/
PK_AXA_fun.yar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
rule PK_AXA_fun : AXA
{
meta:
description = "Phishing Kit impersonating AXA banque"
licence = "GPL-3.0"
author = "Thomas Damonneville"
reference = ""
date = "2023-05-02"
comment = "Phishing Kit - AXA - using a fun.php page"
strings:
// the zipfile working on
$zip_file = { 50 4b 03 04 }
$spec_dir = "css"
$spec_dir2 = "images"
// specific file found in PhishingKit
$spec_file = "detail.html"
$spec_file2 = "fun.php"
$spec_file3 = "fin.html"
$spec_file4 = "axa_pp_blanc.min.css"
condition:
// look for the ZIP header
uint32(0) == 0x04034b50 and
// make sure we have a local file header
$zip_file and
// check for file
all of ($spec_file*) and
all of ($spec_dir*)
}