-
Notifications
You must be signed in to change notification settings - Fork 35
/
PK_BCP_manito.yar
31 lines (29 loc) · 872 Bytes
/
PK_BCP_manito.yar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
rule PK_BCP_manito : BCP
{
meta:
description = "Phishing Kit impersonating Banco de Credito"
licence = "GPL-3.0"
author = "Thomas 'tAd' Damonneville"
reference = ""
date = "2020-10-08"
comment = "Phishing Kit - BCP"
strings:
// the zipfile working on
$zip_file = { 50 4b 03 04 }
// specific directory found in PhishingKit
$spec_dir = "panel"
// specific file found in PhishingKit
$spec_file = "loginx.php"
$spec_file2 = "loli_manito_panel_style.css"
$spec_file3 = "correo.php"
condition:
// look for the ZIP header
uint32(0) == 0x04034b50 and
// make sure we have a local file header
$zip_file and
// check for file
$spec_file and
$spec_file2 and
$spec_file3 and
$spec_dir
}