GET2 yara sig

rule Get2_loader_bin
{
    meta:
        description = "Get2 loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/2df343eb-df3b-400d-affc-3bf04fa5484c/"
        date = "2019/10"
        maltype = "Loader"

    strings:
        $string1 = "&OS=" wide
        $string2 = "&OSA=" wide
        $string3 = "Failed to open the target process"
        $string4 = "Failed to inject the DLL"
        $string5 = "&PR=" wide
        $string6 = "\\lowpro" wide
        $string7 = "shutdown /r /t"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Get2_loader_mem
{
    meta:
        description = "Get2 loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/2df343eb-df3b-400d-affc-3bf04fa5484c/"
        date = "2019/10"
        maltype = "Loader"

    strings:
        $string1 = "&OS=" wide
        $string2 = "&OSA=" wide
        $string3 = "Failed to open the target process"
        $string4 = "Failed to inject the DLL"
        $string5 = "&PR=" wide
        $string6 = "\\lowpro" wide
        $string7 = "shutdown /r /t"

    condition:
        all of ($string*) and filesize > 800KB
}