id: powerstar-malware-hash
info:
  name: PowerStar Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects the batch script used to persist PowerStar via Startup.
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2023/2023-06-28%20POWERSTAR/indicators/rules.yar
  tags: malware,charmingkitten

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872'"
          - "sha256(raw) == '977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f'"
          - "sha256(raw) == 'b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585'"
          - "sha256(raw) == 'de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460'"
        condition: or
# digest: 4a0a00473045022100c59f8345390ed874e19a409d83e81e8e4983951424b99e4ec92c55e1fda3095a0220534e1c7739b4a3ebe32295cf964da7913a4209908375470d3bf3a52b0e55ea7d:922c64590222798bb761d5b6d8e72950