2024-06-20 09:42:34 +00:00
|
|
|
id: bluetermite-emdivi-sfx-hash
|
|
|
|
|
info:
|
|
|
|
|
name: Bluetermite Emdivi SFX Malware Hash - Detect
|
|
|
|
|
author: pussycat0x
|
|
|
|
|
severity: info
|
|
|
|
|
reference:
|
|
|
|
|
- https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/
|
|
|
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Bluetermite_Emdivi.yar
|
|
|
|
|
tags: malware,bluetermite
|
|
|
|
|
|
|
|
|
|
file:
|
2024-06-20 12:38:35 +00:00
|
|
|
- extensions:
|
|
|
|
|
- all
|
2024-06-20 09:42:34 +00:00
|
|
|
|
|
|
|
|
matchers:
|
2024-06-20 12:38:35 +00:00
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- "sha256(raw) == '7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196'"
|
|
|
|
|
- "sha256(raw) == '8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b'"
|
|
|
|
|
condition: or
|
