id: blackenergy-vbs-malware-hash
info:
  name: BlackEnergy VBS Agent Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Blackenergy.yar
  tags: malware,blackenergy

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == 'b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f'"
          - "sha256(raw) == '0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd'"
        condition: or
# digest: 4b0a00483046022100dd35c8697b29b51ba6b14fcbe3a51a5ba8e9a1d6861a04871287a6985d575348022100e8881b7e0f6d91af1c12d0deb56e666fec5b4f0e8930010a1886d38fe5d23672:922c64590222798bb761d5b6d8e72950