# Copyright (C) Check Point Software Technologies LTD.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.

from lib.cuckoo.common.abstracts import Signature


class IBankingMalware(Signature):
    name = "android_malware_iBanking"
    description = "iBanking Malware - Detects if files and strings related to iBanking is available in apk (Detection)"
    severity = 5
    categories = ["android", "banker", "malware"]
    authors = ["idanr1986"]
    minimum = "2.0"
    families = ["iBanking"]

    def check_file(self,pattern):
        files = self.get_results("apkinfo", {}).get("files", {})
        for item in files:
            if item["name"] == pattern:
                return item

    def on_complete(self):
        indicators = [
            "bot_id",
            "type_password2"
        ]
        count = 0
        for indicator in indicators:
            subject = self._check_value(pattern=indicator, subject=self.get_results("strings", {}))
            if subject:
                self.mark_ioc('string', subject)
                count += 1
        subject = self.check_file(pattern="res/drawable-xxhdpi/ok_btn.jpg")
        if subject:
            self.mark_ioc('file', subject)
            count += 1

        if count == 3:
            return True
        else:
            return False
