id: powerstar-malware-hash
info:
  name: PowerStar Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects the batch script used to persist PowerStar via Startup.
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2023/2023-06-28%20POWERSTAR/indicators/rules.yar
  tags: malware,charmingkitten

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872'"
          - "sha256(raw) == '977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f'"
          - "sha256(raw) == 'b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585'"
          - "sha256(raw) == 'de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460'"
        condition: or
# digest: 4a0a00473045022100bd11433a193f24c11464bde90be64222a6a88ac28161fee13929494765e73b7b02202ec17c9e085898b480f5ecc733efe418d8fa6681e88c02c9014572770f5aad74:922c64590222798bb761d5b6d8e72950