mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-08 11:43:17 +08:00
34 lines
2.0 KiB
YAML
34 lines
2.0 KiB
YAML
id: cloudduke-malware-hash
|
|
info:
|
|
name: CloudDuke Malware Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
reference:
|
|
- https://www.f-secure.com/weblog/archives/00002822.html
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Cloudduke.yar
|
|
tags: malware,apt
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7'"
|
|
- "sha256(raw) == '88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f'"
|
|
- "sha256(raw) == '1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7'"
|
|
- "sha256(raw) == '97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7'"
|
|
- "sha256(raw) == '1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7'"
|
|
- "sha256(raw) == '88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f'"
|
|
- "sha256(raw) == 'ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46'"
|
|
- "sha256(raw) == '97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7'"
|
|
- "sha256(raw) == 'ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46'"
|
|
- "sha256(raw) == 'ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145'"
|
|
- "sha256(raw) == 'a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004'"
|
|
- "sha256(raw) == '56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e'"
|
|
- "sha256(raw) == 'ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145'"
|
|
- "sha256(raw) == 'a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004'"
|
|
- "sha256(raw) == '56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e'"
|
|
condition: or
|
|
# digest: 4b0a00483046022100f7a4bbe1b024bdcafd670d8346db825d11761f5dbe477330030e18e36979b844022100ac965ee9ed7a7c6e074e1009648d2bd981595dbfeb221ff40fff6a329373b549:922c64590222798bb761d5b6d8e72950 |