22 lines
813 B
YAML
22 lines
813 B
YAML
id: sfx1-malware-hash
|
|
info:
|
|
name: Malicious SFX1 Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: SFX with voicemail content
|
|
reference:
|
|
- http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Minidionis.yar
|
|
tags: malware,sfx1
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == 'c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f'"
|
|
- "sha256(raw) == '502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d'"
|
|
condition: or
|
|
# digest: 4a0a0047304502204272d1926af9a4b43db2568f6d4c0bf65679cbc954a8e2b460218757bd396aca022100d8fa5e49e3e86ad3ed76354cf1429765f7a0dda2459a041030ddf85eb7093aa6:922c64590222798bb761d5b6d8e72950 |