[[ fm.text ]] Click here

VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate

YARA detection rule by threatintel@volexity.com · See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt

Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication.

rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate: EVILBAMBOO FILE {
  meta:
    description  = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
    author       = "threatintel@volexity.com"
    id           = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0"
    date         = "2023-06-01"
    modified     = "2023-06-13"
    reference    = "https://github.com/volexity/threat-intel"
    source_url   = "https://github.com/volexity/threat-intel/blob/62e031ea574efde68dac7d38dc23438466a5302b/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
    license_url  = "https://github.com/volexity/threat-intel/blob/62e031ea574efde68dac7d38dc23438466a5302b/LICENSE.txt"
    logic_hash   = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
    score        = 75
    quality      = 80
    tags         = "EVILBAMBOO, FILE"
    hash1        = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
    scan_context = "file"
    license      = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"

  strings:
    $b1 = { 30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b }
    $s1 = "california1"
    $s2 = "los1"
    $s3 = "tech1"
    $s4 = "common1"
    $s5 = "common0"
    $s6 = "220401234506Z"
    $s7 = "470326234506Z0a1"

  condition:
    $b1 at 0 or all of ($s*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

85bfc5fa-2324-4895-b27d-e054de3a4ada

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion