mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-08 03:33:18 +08:00
21 lines
808 B
YAML
21 lines
808 B
YAML
id: neuron2-malware-hash
|
|
info:
|
|
name: Neuron2 Loader Strings Turla APT loader Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
reference: |
|
|
- https://www.ncsc.gov.uk/alerts/turla-group-malware
|
|
- https://github.com/Yara-Rules/rules/blob/master/malware/APT_Turla_Neuron.yar
|
|
tags: malware,turla,neuron2,apt
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927'"
|
|
- "sha256(raw) == '83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015'"
|
|
condition: or
|
|
# digest: 4a0a00473045022100e9fec530603174c4137c0bcc93d43654f0cdbacea412edaf9a17677222301bdc022015df886b91b4374a776626c7e099b3662221dfedd9dd85a830f0628f66747a94:922c64590222798bb761d5b6d8e72950 |