id: purplewave-malware-hash
info:
  name: PurpleWave v1.0 Malware Hash - Detect
  author: pussycat0x
  severity: info
  reference:
    - https://twitter.com/3xp0rtblog/status/1289125217751781376
    - https://github.com/Yara-Rules/rules/blob/master/malware/MALW_PurpleWave.yar
  tags: malware,apt,purplewave

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '7de7b866c46f34be28f7085fb1a1727ab939d65abd3128871fb68c42371af2df'"
          - "sha256(raw) == '76bffcf04104a1c4e6a5792d3795d1a03c7497a274042889b8f44c8f8facc304'"
          - "sha256(raw) == '832d667b00c07424f050f84e717f8db22833b1e8e131aa7a33de739c4f4b4cdd'"
          - "sha256(raw) == '917057a6a03252bc2525b326a63111fce050fc86e6e3b26fa9e452489f1358b9'"
          - "sha256(raw) == 'a8577e1ccad877ae5ff4bf89aa578989404643c6fdf10baafd4335a1766abb16'"
          - "sha256(raw) == 'd5ec98c98a8f56fdeb00cc2404c4527a39726bf43d8b9cf6c4c8c36364f94161'"
          - "sha256(raw) == 'd820ec7f9196a5cc3dbc2b5860334a2e174fede80efc3b8463756fb8767dddf9'"
          - "sha256(raw) == 'd4572e26b9e6ce963af590979afe3df6e1be78aa8ec0e926e77b0affb7ab1554'"
          - "sha256(raw) == '4b3cb90581dcd77c9ceffbd662b8dac70b68de5a03cd56940434cc035209d61d'"
        condition: or
# digest: 4b0a00483046022100b7b035593e6ac73b368c81c5f30e811ceaad331c2a50a6f938ee28e4b4e25ae8022100c81f1736a6247475240a1c99f167dd239a7d8738409294e31e681e836a2f796d:922c64590222798bb761d5b6d8e72950