id: blackenergy-vbs-malware-hash
info:
  name: BlackEnergy VBS Agent Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Blackenergy.yar
  tags: malware,blackenergy

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == 'b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f'"
          - "sha256(raw) == '0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd'"
        condition: or
# digest: 4a0a00473045022002c76751e5ad566cb8413c023da8be49add7c2ae10cf0bd813bbef9df4e4653c022100c702b2bf659b7b6b394d0e3d83fccbfc1ac9abaf111795fa97abbd903558688d:922c64590222798bb761d5b6d8e72950