APKiD
APKiD copied to clipboard
rednaga
Added protector to yara (FreeRASP)
Added a protector to yara rules for APK.
- URL of the protector: Talsec.
- Tested APK: 2b8faa038bf34474075a56e2fda7887a7df9c3c57db8a9f25547dc9374137ec9.
- More information: https://github.com/talsec/Free-RASP-Android
Added a protector to yara rules for APK.
- URL of the protector: Talsec.
- Tested APK: 2b8faa038bf34474075a56e2fda7887a7df9c3c57db8a9f25547dc9374137ec9.
- More information: https://github.com/talsec/Free-RASP-Android
@Fare9 This rule need slight modification as https://virustotal.com/gui/file/e10b8772fd9b6aaf8ba030c5bcb324fb9b91f34e893a62bdf238629df856e047 not matching with it . There is no asset/talsec file
Ready to be merged @Fare9. What do you think about @apkunpacker's comment?
I can balance the whitespaces, regarding what @apkunpacker says, I have not been able to download the APK for testing it, I tested it with applications generated with Android Studio, and using the provided configuration from the FreeRASP webpage. In the cases I generated they had the asset of talsec, and also the libraries. The libsecurity.so, for example, is where all the protections of anti-analysis are implemented.
I can balance the whitespaces, regarding what @apkunpacker says, I have not been able to download the APK for testing it, I tested it with applications generated with Android Studio, and using the provided configuration from the FreeRASP webpage. In the cases I generated they had the asset of talsec, and also the libraries. The libsecurity.so, for example, is where all the protections of anti-analysis are implemented.
Here is sample attached TalsecRaspSample.apk.zip
Will check the yara with that apk, and modify it accordingly to detect that one, and detect all those from my dataset too as test. Thanks!
For what I see there are not assets in this APK, but the libraries are included, I can change it tonight. And probably add some of DEX or ELF that they have in common between these apps.
Okay, I will add a last commit, one with the asset the other without it, the rule will be _old and _new, and yes I will be happy to include the code from the offsets, in that way as you said is easier to understand the rule (I was worried that the code would be too verbose)