28 lines
1.4 KiB
YAML
28 lines
1.4 KiB
YAML
id: poseidongroup-maldoc-malware-hash
|
|
info:
|
|
name: Poseidon Group Malicious Word Document Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: Detects Poseidon Group - Malicious Word Document
|
|
reference:
|
|
- https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Poseidon_Group.yar
|
|
tags: malware,poseidon
|
|
|
|
file:
|
|
- extensions:
|
|
- doc
|
|
- docx
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c'"
|
|
- "sha256(raw) == '1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af'"
|
|
- "sha256(raw) == 'f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a'"
|
|
- "sha256(raw) == 'ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed'"
|
|
- "sha256(raw) == '27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778'"
|
|
- "sha256(raw) == '1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216'"
|
|
- "sha256(raw) == '0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b'"
|
|
condition: or
|
|
# digest: 4a0a0047304502205c7960057abca1e94efd07fcd2bc813a5dcd5209f873d23868e1f0d5a19ca821022100a17c02d95228708905fc176fa851e56d051a4e511b917a5102f38367137469c9:922c64590222798bb761d5b6d8e72950 |