2024-06-20 09:42:34 +00:00
|
|
|
id: powerstar-malware-hash
|
2024-06-19 10:13:35 +00:00
|
|
|
info:
|
2024-06-20 09:42:34 +00:00
|
|
|
name: PowerStar Malware Hash - Detect
|
2024-06-19 10:13:35 +00:00
|
|
|
author: pussycat0x
|
|
|
|
|
severity: info
|
|
|
|
|
description: Detects the batch script used to persist PowerStar via Startup.
|
|
|
|
|
reference:
|
|
|
|
|
- https://github.com/volexity/threat-intel/blob/main/2023/2023-06-28%20POWERSTAR/indicators/rules.yar
|
|
|
|
|
tags: malware,charmingkitten
|
|
|
|
|
|
|
|
|
|
file:
|
|
|
|
|
- extensions:
|
|
|
|
|
- all
|
|
|
|
|
|
|
|
|
|
matchers:
|
|
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- "sha256(raw) == '9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872'"
|
|
|
|
|
- "sha256(raw) == '977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f'"
|
|
|
|
|
- "sha256(raw) == 'b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585'"
|
|
|
|
|
- "sha256(raw) == 'de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460'"
|
2024-06-21 10:04:41 +00:00
|
|
|
condition: or
|
|
|
|
|
# digest: 4a0a00473045022100c59f8345390ed874e19a409d83e81e8e4983951424b99e4ec92c55e1fda3095a0220534e1c7739b4a3ebe32295cf964da7913a4209908375470d3bf3a52b0e55ea7d:922c64590222798bb761d5b6d8e72950
|
