motorola-g04s-t606-spreadtrum/Simjacker.yar at main · lexs201992-gif/motorola-g04s-t606-spreadtrum · GitHub
//blob/show" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
lexs201992-gif
motorola-g04s-t606-spreadtrum
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
FilesExpand file tree
main
/Simjacker.yar
Copy path
Blame<br>More file actions
Blame<br>More file actions
Latest commit
History<br>History<br>History
80 lines (69 loc) · 2.96 KB
main
/Simjacker.yar
Copy path
Top
File metadata and controls<br>Code
Blame
80 lines (69 loc) · 2.96 KB
Raw<br>Copy raw file<br>Download raw file
Open symbols panelEdit and raw actions
10<br>11<br>12<br>13<br>14<br>15<br>16<br>17<br>18<br>19<br>20<br>21<br>22<br>23<br>24<br>25<br>26<br>27<br>28<br>29<br>30<br>31<br>32<br>33<br>34<br>35<br>36<br>37<br>38<br>39<br>40<br>41<br>42<br>43<br>44<br>45<br>46<br>47<br>48<br>49<br>50<br>51<br>52<br>53<br>54<br>55<br>56<br>57<br>58<br>59<br>60<br>61<br>62<br>63<br>64<br>65<br>66<br>67<br>68<br>69<br>70<br>71<br>72<br>73<br>74<br>75<br>76<br>77<br>78<br>79<br>80
rule Unisoc_Longcheer_STK_SHA256 {
meta:
description = "Identifies the compromised Longcheer SIM Toolkit binary by exact SHA256"
author = "lexs201992-gif"
date = "2026-07-10"
severity = "CRITICAL"
sha256 = "4cfe803b578fd6958d236e494248585eccbc5c33a5113bda7ff1a47351e4118d"
package = "com.android.stk"
reference = "Addendum 82-C"
strings:
$sha256_hex = "4cfe803b578fd6958d236e494248585eccbc5c33a5113bda7ff1a47351e4118d" ascii
$pkg_name = "com.android.stk" ascii
$stk_class = "Lcom/android/stk/StkAppService;" ascii
$longcheer_cert = "CN=Longcheer" ascii
condition:
$sha256_hex in file or
(all of ($pkg_name, $stk_class, $longcheer_cert))
rule Unisoc_STK_Intent_Injection_Vulnerability {
meta:
description = "Detects vulnerable StkCmdReceiver implementation allowing intent injection"
author = "lexs201992-gif"
date = "2026-07-10"
severity = "HIGH"
cve = "CVE-2015-3843-Variant"
strings:
$receiver_class = "Lcom/android/stk/StkCmdReceiver;" ascii
$intent_action = "com.android.internal.stk.command" ascii
$handle_action = "handleAction" ascii
$on_receive = "onReceive" ascii
$exported_true = "exported=\"true\"" ascii wide
$permission_none = "android:permission=\"\"" ascii wide
condition:
(all of ($receiver_class, $intent_action, $handle_action)) and
($exported_true in file or $permission_none in file)
rule Unisoc_STK_UI_Spoofing_Capability {
meta:
description = "Identifies STK components capable of UI spoofing and overlay attacks"
author = "lexs201992-gif"
date = "2026-07-10"
severity = "MEDIUM"
attack_type = "Social Engineering"
strings:
$dialog_activity = "Lcom/android/stk/StkDialogActivity;" ascii
$translucent_theme = "Theme.Translucent.NoTitleBar" ascii
$exclude_recents = "excludeFromRecents=\"true\"" ascii wide
$text_message = "Lcom/android/internal/telephony/cat/TextMessage;" ascii
$send_response = "sendResponse" ascii
condition:
(all of ($dialog_activity, $translucent_theme, $exclude_recents)) and
(any of ($text_message, $send_response))
rule Unisoc_STK_Persistence_Mechanism {
meta:
description = "Detects boot persistence receivers in compromised STK"
author = "lexs201992-gif"
date = "2026-07-10"
severity = "HIGH"
persistence = "Boot Completed"
strings:
$boot_receiver = "Lcom/android/stk/BootCompletedReceiver;" ascii
$boot_action = "android.intent.action.BOOT_COMPLETED" ascii
$sim_change = "android.telephony.action.SIM_CARD_STATE_CHANGED" ascii
$start_service = "startServiceByBootCompleted" ascii
condition:
(all of ($boot_receiver, $boot_action, $sim_change)) and
($start_service in file)
You can’t perform that action at this time.