id: flipflop-ldr-malware-hash info: name: Flipflop Loader Hash - Detect author: pussycat0x severity: info description: A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload. reference: - https://github.com/volexity/threat-intel/blob/main/2021/2021-05-27%20-%20Suspected%20APT29%20Operation%20Launches%20Election%20Fraud%20Themed%20Phishing%20Campaigns/indicators/yara.yar tags: malware,apt29,cobaltstrike file: - extensions: - all matchers: - type: dsl dsl: - "sha256(raw) == 'ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330'" - "sha256(raw) == 'b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c'" - "sha256(raw) == 'ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c'" condition: or # digest: 4b0a00483046022100898dba3d21d00acd15b0d9328ff3c9b58792f741caff519072c7a6649f37a2bb022100980b0d759b9d2b8464858ecaa9bb3f65db5588bd5dccacf73ad8e95beb6ba0a7:922c64590222798bb761d5b6d8e72950