id: upstyle-malware-hash

info:
  name: Upstyle Malware Hash - Detect
  author: s4e-io
  severity: info
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2024/2024-04-12%20Palo%20Alto%20Networks%20GlobalProtect/indicators/rules.yar
  tags: malware,upstyle

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac'"
          - "sha256(raw) == '0d59d7bddac6c22230187ef6cf7fa22bca93759edc6f9127c41dc28a2cea19d8'"
          - "sha256(raw) == '4dd4bd027f060f325bf6a90d01bfcf4e7751a3775ad0246beacc6eb2bad5ec6f'"
        condition: or
# digest: 4a0a00473045022100cf8ac1990fca7562d9c9562889165949813be285647fa8804461c7045c13dc2f0220520589204ce1df8cc8c798a487a00dd2ee618e358f3c52b82db27c9e1fd7c9c6:922c64590222798bb761d5b6d8e72950