id: sauron-malware-hash
info:
  name: Sauron Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects malware from Project Sauron APT
  reference:
    - https://goo.gl/eFoP4A
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Sauron_extras.yar
  tags: malware,apt,sauron

file:
  extensions:
    - all

  matchers:
    type: dsl
    dsl:
      - "sha256(raw) == '9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9'"
      - "sha256(raw) == '30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8'"
      - "sha256(raw) == 'a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec'"
      - "sha256(raw) == 'e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57'"
      - "sha256(raw) == '3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8'"
      - "sha256(raw) == '7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca'"
      - "sha256(raw) == '6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd'"
    condition: or