id: sauron-malware-hash
info:
  name: Sauron Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects malware from Project Sauron APT
  reference:
    - https://goo.gl/eFoP4A
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Sauron_extras.yar
  tags: malware,apt,sauron

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9'"
          - "sha256(raw) == '30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8'"
          - "sha256(raw) == 'a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec'"
          - "sha256(raw) == 'e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57'"
          - "sha256(raw) == '3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8'"
          - "sha256(raw) == '7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca'"
          - "sha256(raw) == '6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd'"
        condition: or
# digest: 4a0a004730450221008e7a7a44b0f2312c12e329c1fa90993dca6639bfcaf506375a7e19199f928d91022049aea6fa5d5e897ced02e4b011a1fe807c1740d31288ded179adef93a324b451:922c64590222798bb761d5b6d8e72950