27 lines
1.3 KiB
YAML
27 lines
1.3 KiB
YAML
id: sauron-malware-hash
|
|
info:
|
|
name: Sauron Malware Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: Detects malware from Project Sauron APT
|
|
reference:
|
|
- https://goo.gl/eFoP4A
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Sauron_extras.yar
|
|
tags: malware,apt,sauron
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9'"
|
|
- "sha256(raw) == '30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8'"
|
|
- "sha256(raw) == 'a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec'"
|
|
- "sha256(raw) == 'e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57'"
|
|
- "sha256(raw) == '3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8'"
|
|
- "sha256(raw) == '7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca'"
|
|
- "sha256(raw) == '6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd'"
|
|
condition: or
|
|
# digest: 4a0a004730450221008e7a7a44b0f2312c12e329c1fa90993dca6639bfcaf506375a7e19199f928d91022049aea6fa5d5e897ced02e4b011a1fe807c1740d31288ded179adef93a324b451:922c64590222798bb761d5b6d8e72950 |