id: applejeus-malware-hash
info:
  name: AppleJeus Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects AppleJeus DLL samples
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2022/2022-12-01%20Buyer%20Beware%20-%20Fake%20Cryptocurrency%20Applications%20Serving%20as%20Front%20for%20AppleJeus%20Malware/yara.yar
  tags: malware,lazarus

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629'"
          - "sha256(raw) == '9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78'"
          - "sha256(raw) == 'a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb'"
          - "sha256(raw) == 'a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379'"
          - "sha256(raw) == '17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b'"
        condition: or
# digest: 4a0a00473045022100ce4547a621064d4725017391fd1cc5b05a3843fb88352389c1a1aa5001f605e90220260ec3640663551752c15d89749938e0f067e6e4e7dd61f2a69cfefc884d600c:922c64590222798bb761d5b6d8e72950