id: poseidongroup-malware-hash
info:
  name: Poseidon Group Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects Poseidon Group Malware
  reference:
    - https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Poseidon_Group.yar
  tags: malware

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4'"
          - "sha256(raw) == '344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3'"
          - "sha256(raw) == '432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61'"
          - "sha256(raw) == '8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47'"
          - "sha256(raw) == 'd090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f'"
          - "sha256(raw) == 'd7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb'"
          - "sha256(raw) == 'ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3'"
        condition: or
# digest: 4b0a00483046022100f7c5703b73da9fe78478c825c053b67e4e75371245aa7489cb0a22ead0ee79d5022100f4a0150095490908afb25a07519eff6b905131b6a0f58e304d61b2d15d18c029:922c64590222798bb761d5b6d8e72950