nuclei-templates/file/malware/hash/powerstar-malware-hash.yaml

23 lines
1020 B
YAML

id: powerstar-malware-hash
info:
name: PowerStar Malware Hash - Detect
author: pussycat0x
severity: info
description: Detects the batch script used to persist PowerStar via Startup.
reference:
- https://github.com/volexity/threat-intel/blob/main/2023/2023-06-28%20POWERSTAR/indicators/rules.yar
tags: malware,charmingkitten
file:
- extensions:
- all
matchers:
- type: dsl
dsl:
- "sha256(raw) == '9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872'"
- "sha256(raw) == '977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f'"
- "sha256(raw) == 'b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585'"
- "sha256(raw) == 'de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460'"
condition: or
# digest: 4a0a00473045022100c59f8345390ed874e19a409d83e81e8e4983951424b99e4ec92c55e1fda3095a0220534e1c7739b4a3ebe32295cf964da7913a4209908375470d3bf3a52b0e55ea7d:922c64590222798bb761d5b6d8e72950