{"id":13705813,"url":"https://github.com/t4d/PhishingKit-Yara-Rules","last_synced_at":"2025-05-05T17:30:44.579Z","repository":{"id":47327833,"uuid":"230866395","full_name":"t4d/PhishingKit-Yara-Rules","owner":"t4d","description":"Repository of Yara rules dedicated to Phishing Kits Zip files","archived":false,"fork":false,"pushed_at":"2024-10-27T20:44:52.000Z","size":772,"stargazers_count":205,"open_issues_count":0,"forks_count":35,"subscribers_count":20,"default_branch":"master","last_synced_at":"2024-10-28T00:55:30.126Z","etag":null,"topics":["phishing","phishing-detection","phishing-kit","yara"],"latest_commit_sha":null,"homepage":null,"language":"YARA","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/t4d.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-12-30T07:07:47.000Z","updated_at":"2024-10-27T20:44:55.000Z","dependencies_parsed_at":"2024-03-24T10:23:35.144Z","dependency_job_id":"053e1524-1093-40a3-bd29-3dd361bcdf0d","html_url":"https://github.com/t4d/PhishingKit-Yara-Rules","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/t4d%2FPhishingKit-Yara-Rules","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/t4d%2FPhishingKit-Yara-Rules/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/t4d%2FPhishingKit-Yara-Rules/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/t4d%2FPhishingKit-Yara-Rules/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/t4d","download_url":"https://codeload.github.com/t4d/PhishingKit-Yara-Rules/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224455929,"owners_count":17314208,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["phishing","phishing-detection","phishing-kit","yara"],"created_at":"2024-08-02T22:00:48.346Z","updated_at":"2025-05-05T17:30:44.572Z","avatar_url":"https://github.com/t4d.png","language":"YARA","funding_links":["https://www.buymeacoffee.com/tad0","https://img.buymeacoffee.com/button-api/?text=Buy"],"categories":["Rules","YARA (8)","YARA"],"sub_categories":[],"readme":"\nPhishingKit-Yara-Rules is a [StalkPhish Project](https://stalkphish.com)\n\n## YARA repository for Phishing Kits zip files\nThis repository, dedicated to Phishing Kits zip files YARA rules, is based on zip raw format analysis to find directories and files names, you don't need yara-extend there.\nThis repository is open to all rules contribution, feel free to create pull request with your own set of rules, sharing knowledge is the better way to improve our detection and defence against Phishing threat. \nThe first set of rules has been created for the project [PhishingKit-Yara-Search](https://github.com/t4d/PhishingKit-Yara-Search).\nTo write your own rules you can refered to [YARA's documentation](https://yara.readthedocs.org/) or the example behind.\n\n## Phishing Kit YARA rule example\nThis rule detect PayPal Phishing kit, named H3ATSTR0K3, testing for some specific files and directory presence:\n```yara\nrule PK_PayPal_H3ATSTR0K3 : PayPal\n{\n    meta:\n        description = \"Phishing Kit impersonating PayPal\"\n        licence = \"GPL-3.0\"\n        author = \"Thomas 'tAd' Damonneville\"\n        reference = \"\"\n        date = \"2019-11-28\"\n        comment = \"Phishing Kit - PayPal - H3ATSTR0K3\"\n\n    strings:\n        // the zipfile working on\n        $zip_file = { 50 4b 03 04 }\n        // specific directory found in PhishingKit\n        $spec_dir = \"prevents\"\n        // specific file found in PhishingKit\n        $spec_file = \"mine.php\" nocase\n        $spec_file2 = \"bcce592108d8ec029aa75f951662de2e.jpeg\"\n        $spec_file3 = \"captured.txt\"\n        $spec_file4 = \"H3ATSTR0K3.txt\"\n\n    condition:\n        // look for the ZIP header\n        uint32(0) == 0x04034b50 and\n        // make sure we have a local file header\n        $zip_file and\n        // check for file\n        $spec_file and\n        $spec_file2 and\n        $spec_file3 and\n        $spec_file4 and\n        // check for directory\n        $spec_dir\n}\n```\n\n## Requirements\nYara is required for most of those rules to work. The better is to use the [PhishingKit-Yara-Search](https://github.com/t4d/PhishingKit-Yara-Search) project, dedicated to Phishing Kits zip files analysis.\nNo need of yara-extend 'cause YARA will only check for directories and files names in raw zip file format.\n\n## Contributing\nPull requests and issues with suggestions are welcome!\nSee [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## Support\nIf you like this project, you can buy me a coffee!\n\n\u003ca href=\"https://www.buymeacoffee.com/tad0\"\u003e\u003cimg src=\"https://img.buymeacoffee.com/button-api/?text=Buy me a coffee\u0026emoji=\u0026slug=tad0\u0026button_colour=FFDD00\u0026font_colour=000000\u0026font_family=Cookie\u0026outline_colour=000000\u0026coffee_colour=ffffff\" /\u003e\u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ft4d%2FPhishingKit-Yara-Rules","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ft4d%2FPhishingKit-Yara-Rules","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ft4d%2FPhishingKit-Yara-Rules/lists"}