id: blackenergy-ssh-malware-hash
info:
  name: BlackEnergy BackdoorPass DropBear SSH Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects the password of the backdoored DropBear SSH Server - BlackEnergy
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Blackenergy.yar
  tags: malware,blackenergy

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd'"
# digest: 490a00463044022076c79a680bd960058e6016bae49634bf00a7b5f0619124a99c6e1dde41acb9cb022061ea2328a1e992e649b841e6a0c6c8bde76247ab1174cf2846b01cb5912740cd:922c64590222798bb761d5b6d8e72950