yara sha384.tt

rule SHA384_Constants {
        meta:
                author = "Joe Gregg"
                description = "Search for SHA384 constants"
                date = "2016-08-09"
                version = "1"
        strings:
                $c0 = { CBBB9D5DC1059ED8  }
                $c1 = { 629A292A367CD507  }
                $c2 = { 9159015A3070DD17  }
                $c3 = { 152FECD8F70E5939  }
                $c4 = { 67332667FFC00B31  }
                $c5 = { 8EB44A8768581511  }
                $c6 = { DB0C2E0D64F98FA7  }
                $c7 = { 47B5481DBEFA4FA4  }
        condition:
                4 of ($c0,$c1,$c2,$c3,$c4,$c5,$c6,$c7)
}