id: bluetermite-emdivi-sfx-hash
info:
  name: Bluetermite Emdivi SFX Malware Hash - Detect
  author: pussycat0x
  severity: info
  reference:
    - https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Bluetermite_Emdivi.yar
  tags: malware,bluetermite

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196'"
          - "sha256(raw) == '8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b'"
        condition: or
# digest: 4b0a00483046022100c3951dfa51d81f15562dfc7ef7e1497fa05b5213c180f176f881ea810893180e022100aebc7f5996bd826ebad5aacf5bf4bc311f407657a67bd2f87a29e722eb94f5d6:922c64590222798bb761d5b6d8e72950