id: andromeda-malware

info:
  name: Andromeda Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Andromeda.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: word
        part: raw
        words:
          - 'hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst'

      - type: binary
        binary:
          - "1C1C1D03494746"
# digest: 490a0046304402200b9c9cb87d991b4a41f7ca9410759aab18c2cbaf81ee16f3e6acc0d38077ad2002201e62aa71526c6586d77db2a142550133c7118be2be0102c109e5df9ba60ee095:922c64590222798bb761d5b6d8e72950