-
Notifications
You must be signed in to change notification settings - Fork 34
/
Copy pathPK_1and1_Ionos.yar
32 lines (29 loc) · 909 Bytes
/
PK_1and1_Ionos.yar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
rule PK_1and1_Ionos : one_and_one
{
meta:
description = "Phishing Kit impersonating IONOS by 1and1"
licence = "GPL-3.0"
author = "Thomas 'tAd' Damonneville"
reference = ""
date = "2020-10-02"
comment = "Phishing Kit - 1and1"
strings:
// the zipfile working on
$zip_file = { 50 4b 03 04 }
// specific directory found in PhishingKit
$spec_dir = "1&1 IONOS E-Mail login_files"
// specific file found in PhishingKit
$spec_file = "1and1.php"
$spec_file2 = "1&1 IONOS E-Mail login.html"
$spec_file3 = "ionos.min.css"
condition:
// look for the ZIP header
uint32(0) == 0x04034b50 and
// make sure we have a local file header
$zip_file and
$spec_dir and
// check for file
$spec_file and
$spec_file2 and
$spec_file3
}