id: applejeus-malware-hash
info:
  name: AppleJeus Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects AppleJeus DLL samples
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2022/2022-12-01%20Buyer%20Beware%20-%20Fake%20Cryptocurrency%20Applications%20Serving%20as%20Front%20for%20AppleJeus%20Malware/yara.yar
  tags: malware,lazarus

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629'"
          - "sha256(raw) == '9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78'"
          - "sha256(raw) == 'a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb'"
          - "sha256(raw) == 'a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379'"
          - "sha256(raw) == '17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b'"
        condition: or
# digest: 4b0a00483046022100b9ffe0405c3e1b2f5a78f7d35de9fcebe05f08f84e56688356b9784e8d8eebc7022100b90a82c2f36e07835c7e7d7e198ce96fb361be2e9eed76e3cae80063fcc89a9d:922c64590222798bb761d5b6d8e72950