id: sharpext-malware-hash
info:
  name: Sharpext Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: A malicious Chrome browser extension used by the SharpTongue threat actor to steal mail data from a victim.
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2022/2022-07-28%20SharpTongue%20SharpTongue%20Deploys%20Clever%20Mail-Stealing%20Browser%20Extension%20SHARPEXT/yara.yar
  tags: malware,sharptongue

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00'"
          - "sha256(raw) == '6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4'"
          - "sha256(raw) == '6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c'"
        condition: or
# digest: 490a0046304402203cda5b3c2db04f5830c24339e67b5819aadae879dfbb4f7004f484dd92c1d3ec022077e6b2a75c77c8504919a75818cd9a6689e7b8a1d91e0a1240db0a68a7fe6ca1:922c64590222798bb761d5b6d8e72950