improve yidun(NetEase) detection rule (#404)

rednaga · Oct 14, 2024 · d30d103 · d30d103
1 parent 554a789
commit d30d103
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/apkid/rules/apk/packers.yara b/apkid/rules/apk/packers.yara
@@ -786,9 +786,11 @@ rule yidun : packer
     $entry_point = "Lcom/netease/nis/wrapper/Entry"
     $jni_func = "Lcom/netease/nis/wrapper/MyJni"
     $lib = "libnesec.so"
+    $nedata = "assets/nedata.db"
+    $nedig = "assets/nedig.properties"
 
   condition:
-    is_apk and (#lib > 1) or ($anti_trick and $entry_point and $jni_func)
+    is_apk and (#lib > 1 or ($anti_trick and $entry_point and $jni_func) or ($nedata and $nedig))
 }
 
 rule apkpacker : packer