id: locky-ransomware-hash
info:
  name: Locky Ransomware Hash - Detect
  author: pussycat0x
  severity: info
  description: |
    Detects Locky Ransomware (matches also on Win32/Kuluoz)
  reference:
    - https://goo.gl/qScSrE
    - https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_Locky.yar
  tags: ransomware,malware

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8'"
# digest: 4a0a0047304502206640dae42866d0e1f2b4cc08c9d50c9f16f06ead5f0fbaf4833a9002092be713022100f4ed1b00e32d8237ca1f1eda3d18dae1a421678bd13f6f5992589ca556e6301e:922c64590222798bb761d5b6d8e72950