27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
id: sauron-malware-hash
|
|
info:
|
|
name: Sauron Malware Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: Detects malware from Project Sauron APT
|
|
reference:
|
|
- https://goo.gl/eFoP4A
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Sauron_extras.yar
|
|
tags: malware,apt,sauron
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9'"
|
|
- "sha256(raw) == '30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8'"
|
|
- "sha256(raw) == 'a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec'"
|
|
- "sha256(raw) == 'e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57'"
|
|
- "sha256(raw) == '3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8'"
|
|
- "sha256(raw) == '7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca'"
|
|
- "sha256(raw) == '6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd'"
|
|
condition: or
|