2024-06-20 09:42:34 +00:00
|
|
|
id: sfx1-malware-hash
|
|
|
|
|
info:
|
|
|
|
|
name: Malicious SFX1 Hash - Detect
|
|
|
|
|
author: pussycat0x
|
|
|
|
|
severity: info
|
|
|
|
|
description: SFX with voicemail content
|
|
|
|
|
reference:
|
|
|
|
|
- http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950
|
|
|
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Minidionis.yar
|
|
|
|
|
tags: malware,sfx1
|
|
|
|
|
|
|
|
|
|
file:
|
2024-06-20 12:38:35 +00:00
|
|
|
- extensions:
|
|
|
|
|
- all
|
2024-06-20 09:42:34 +00:00
|
|
|
|
|
|
|
|
matchers:
|
2024-06-20 12:38:35 +00:00
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- "sha256(raw) == 'c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f'"
|
|
|
|
|
- "sha256(raw) == '502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d'"
|
|
|
|
|
condition: or
|
