id: flipflop-ldr-malware-hash
info:
  name: Flipflop Loader Hash - Detect
  author: pussycat0x
  severity: info
  description: A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload.
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2021/2021-05-27%20-%20Suspected%20APT29%20Operation%20Launches%20Election%20Fraud%20Themed%20Phishing%20Campaigns/indicators/yara.yar
  tags: malware,apt29,cobaltstrike

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == 'ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330'"
          - "sha256(raw) == 'b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c'"
          - "sha256(raw) == 'ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c'"
        condition: or
# digest: 4a0a00473045022004b9e3cd4a4b77c616255d108621cd75b121eba838a94564a9d6ff5b2c7a32f00221009829aafd03d1b08e6872406561aa5b338c2630ad07bab458ce5ab19b3da2871b:922c64590222798bb761d5b6d8e72950