id: petya-ransomware-hash
info:
  name: Petya Ransomware Hash - Detect
  author: pussycat0x
  severity: info
  description: |
    Detects Petya Ransomware.
  reference:
    - http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html
  tags: ransomware,malware

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739'"
# digest: 4a0a004730450220335f96da98461946f7497188cb8cf8e9f5e3660a748d2a2469fcbad8b26b38d7022100ebdf104aee044e7d5f633126295007b3dba3d2a32665a5161452408faeddbc7c:922c64590222798bb761d5b6d8e72950