[[ fm.text ]] Click here

apt_malware_apk_badbazaar_common_certificate

YARA detection rule by threatintel@volexity.com · See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt

Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication.

rule apt_malware_apk_badbazaar_common_certificate: EvilBamboo
{
    meta:
        author = "threatintel@volexity.com"
        description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
        date = "2023-06-01"
        hash1 = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
        scan_context = "file"
        last_modified = "2023-06-13T12:06Z"
        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"

    strings:
        $b1 = {30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b} 
        $s1 = "california1"
        $s2 = "los1"
        $s3 = "tech1"
        $s4 = "common1"
        $s5 = "common0"
        $s6 = "220401234506Z"
        $s7 = "470326234506Z0a1"

    condition:
        $b1 at 0
        or all of ($s*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c74ccfdb-4d36-4216-9a43-7bcdd6111d45

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion