PasswordRecoveryChrome yara sig

rule PasswordRecoveryChrome_bin
{
    meta:
        description = "PasswordRecoveryChrome"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/85249df8-bdf0-4b52-887e-e72d9dc2b7a4"
        date = "2019/04"
        maltype = "Stealer"

    strings:
        $string1 = "PasswordRecoveryChrome.exe"
        $string2 = "OpenPrinterW"
        $string3 = ".aspack"
        $string4 = "__dbk_fcall_wrapper"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 2000KB
}

rule PasswordRecoveryChrome_mem
{
    meta:
        description = "PasswordRecoveryChrome"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/85249df8-bdf0-4b52-887e-e72d9dc2b7a4"
        date = "2019/04"
        maltype = "Stealer"

    strings:
        $string1 = "PasswordRecoveryChrome.exe"
        $string2 = "OpenPrinterW"
        $string3 = ".aspack"
        $string4 = "__dbk_fcall_wrapper"

    condition:
        all of ($string*) and filesize > 2000KB
}