id: blackenergy-ssh-malware-hash
info:
  name: BlackEnergy BackdoorPass DropBear SSH Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects the password of the backdoored DropBear SSH Server - BlackEnergy
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Blackenergy.yar
  tags: malware,blackenergy

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd'"
# digest: 4b0a00483046022100881e31ce7ee7044a7376e7fdb54e451a8811f86ceba285ac316ae5a027d2cef7022100845173c43c2e7eb75d5d35f0639dd292f3f03faae0d199677a387a6149e8cb15:922c64590222798bb761d5b6d8e72950