34 lines
2.0 KiB
YAML
34 lines
2.0 KiB
YAML
id: bluetermite-emdivi-malware-hash
|
|
info:
|
|
name: Bluetermite Emdivi Malware Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
reference:
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Bluetermite_Emdivi.yar
|
|
- https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/
|
|
tags: malware,bluetermite
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24'"
|
|
- "sha256(raw) == '3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1'"
|
|
- "sha256(raw) == '6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662'"
|
|
- "sha256(raw) == '90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86'"
|
|
- "sha256(raw) == '9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1'"
|
|
- "sha256(raw) == 'a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012'"
|
|
- "sha256(raw) == '9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4'"
|
|
- "sha256(raw) == '008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e'"
|
|
- "sha256(raw) == 'a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d'"
|
|
- "sha256(raw) == '008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e'"
|
|
- "sha256(raw) == '17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24'"
|
|
- "sha256(raw) == '3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1'"
|
|
- "sha256(raw) == '6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662'"
|
|
- "sha256(raw) == '90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86'"
|
|
- "sha256(raw) == 'a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d'"
|
|
condition: or
|
|
# digest: 4a0a00473045022100d921976429b755e2f6cc4781a3a9f484091fff45426fef48c161dec9fc213002022035ea8dcd09bf5fe2f185ef8eb60c9ac6c60c1f93be5df28e294140c3f6f196d4:922c64590222798bb761d5b6d8e72950 |