sakura_jar.yar

rule sakura_jar
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "Sakura Exploit Kit Detection"
	hash0 = "a566ba2e3f260c90e01366e8b0d724eb"
	sample_filetype = "unknown"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "Rotok.classPK"
	$string1 = "nnnolg"
	$string2 = "X$Z'\\4^=aEbIdUmiprsxt}v<" wide
	$string3 = "()Ljava/util/Set;"
	$string4 = "(Ljava/lang/String;)V"
	$string5 = "Ljava/lang/Exception;"
	$string6 = "oooy32"
	$string7 = "Too.java"
	$string8 = "bbfwkd"
	$string9 = "Ljava/lang/Process;"
	$string10 = "getParameter"
	$string11 = "length"
	$string12 = "Simio.java"
	$string13 = "Ljavax/swing/JList;"
	$string14 = "-(Ljava/lang/String;)Ljava/lang/StringBuilder;"
	$string15 = "Ljava/io/InputStream;"
	$string16 = "vfnnnrof.exnnnroe"
	$string17 = "Olsnnfw"
condition:
	17 of them
}