27 lines
1.3 KiB
YAML
27 lines
1.3 KiB
YAML
id: poseidongroup-malware-hash
|
|
info:
|
|
name: Poseidon Group Malware Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: Detects Poseidon Group Malware
|
|
reference:
|
|
- https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Poseidon_Group.yar
|
|
tags: malware
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4'"
|
|
- "sha256(raw) == '344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3'"
|
|
- "sha256(raw) == '432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61'"
|
|
- "sha256(raw) == '8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47'"
|
|
- "sha256(raw) == 'd090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f'"
|
|
- "sha256(raw) == 'd7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb'"
|
|
- "sha256(raw) == 'ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3'"
|
|
condition: or
|
|
# digest: 4b0a00483046022100f7c5703b73da9fe78478c825c053b67e4e75371245aa7489cb0a22ead0ee79d5022100f4a0150095490908afb25a07519eff6b905131b6a0f58e304d61b2d15d18c029:922c64590222798bb761d5b6d8e72950 |