id: poseidongroup-maldoc-malware-hash
info:
  name: Poseidon Group Malicious Word Document Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects Poseidon Group - Malicious Word Document
  reference:
    - https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Poseidon_Group.yar
  tags: malware,poseidon

file:
  - extensions:
      - doc
      - docx

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c'"
          - "sha256(raw) == '1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af'"
          - "sha256(raw) == 'f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a'"
          - "sha256(raw) == 'ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed'"
          - "sha256(raw) == '27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778'"
          - "sha256(raw) == '1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216'"
          - "sha256(raw) == '0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b'"
        condition: or
# digest: 4a0a004730450221008222d14be934a4dfc35f313b675bd858dc99753b86d705d40f1e9bb6948c444102200f0f7f22ccbe1336ed0a85f09c0165ebd419ec2e3c09474bc368272d7d7c4676:922c64590222798bb761d5b6d8e72950