id: neuron2-malware-hash
info:
  name: Neuron2 Loader Strings Turla APT loader Hash - Detect
  author: pussycat0x
  severity: info
  reference:
    - https://www.ncsc.gov.uk/alerts/turla-group-malware
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Turla_Neuron.yar
  tags: malware,turla,neuron2,apt

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927'"
          - "sha256(raw) == '83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015'"
        condition: or
# digest: 4a0a00473045022057a3cc9016ee089610bcc5af109d9dbaf0bde60bc5fdfdb057ffd3e4bae1455d022100f1bbca254ab98e605b988949a5440873369af9d30e95a3196be21ac5ccb3ba20:922c64590222798bb761d5b6d8e72950