IcedID yara sig

rule IcedID_loader_bin
{
    meta:
        description = "IcedID Loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/27f86128-ab28-4f2b-975e-e85bc47aff58/"
        date = "2019/10"
        maltype = "Loader"

    strings:
        $string1 = "c:\\Users\\Public\\"
        $string2 = "\\photo.png"
        $string3 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X"
        $string4 = "/photo.png?id=%0.2X%0.8X%0.8X%"
        $string5 = "GET" wide
        $string6 = "GetUserNameA"
        $string7 = "/index.php"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
}

rule IcedID_loader_mem
{
    meta:
        description = "IcedID Loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/27f86128-ab28-4f2b-975e-e85bc47aff58/"
        date = "2019/10"
        maltype = "Loader"

    strings:
        $string1 = "c:\\Users\\Public\\"
        $string2 = "\\photo.png"
        $string3 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X"
        $string4 = "/photo.png?id=%0.2X%0.8X%0.8X%"
        $string5 = "GET" wide
        $string6 = "GetUserNameA"
        $string7 = "/index.php"

    condition:
        all of ($string*) and filesize > 100KB
}