mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-11 05:03:18 +08:00
25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
id: ico-malware-hash
|
|
info:
|
|
name: ICO Malware Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: Detection of malicious ICO files used in 3CX compromise
|
|
reference:
|
|
- https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/indicators/rules.yar
|
|
tags: malware,uta0040
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == 'a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c'"
|
|
- "sha256(raw) == 'a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67'"
|
|
- "sha256(raw) == '8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423'"
|
|
- "sha256(raw) == 'f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952'"
|
|
- "sha256(raw) == '7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896'"
|
|
- "sha256(raw) == 'aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868'"
|
|
condition: or
|
|
# digest: 490a004630440220540d7b2d24e97cc8ece2d2d2df68cf90a897326fcf2c70ac8a6ced353a80840c0220562e657723fd4ee8880806ec16d7bb01c46b309b8a38b2915af197ff5741174e:922c64590222798bb761d5b6d8e72950 |