imminent 2.0

rule Imminent_2_bin
{
    meta:
        description = "Possible new Imminent Rat"
        author = "James_inthe_box"
        reference = "af55fb0b937b2ee6a6f1705167f8b3cd97802dc88b9f2fb019ad7d27869b396a"
        date = "2019/02"
        maltype = "RAT"

    strings:
        $string1 = "keyloggerPath"
        $string2 = "ConnectionKey"
        $string3 = "SCREEN_VIEW_START"
        $string4 = "SCREEN_VIEW_STOP"
        $string5 = "get_Jpeg"
        $string6 = "StopStress"
        $string7 = "SLOWLORIS"
        $string8 = "aforge" wide
        $string9 = "directshow" wide
        $string10 = "Imminent" wide
        $string11 = "firewall set opmode disable" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 400KB
}

rule Imminent_2_mem
{
    meta:
        description = "Possible new Imminent Rat"
        author = "James_inthe_box"
        reference = "af55fb0b937b2ee6a6f1705167f8b3cd97802dc88b9f2fb019ad7d27869b396a"
        date = "2019/02"
        maltype = "RAT"

    strings:
        $string1 = "keyloggerPath"
        $string2 = "ConnectionKey"
        $string3 = "SCREEN_VIEW_START"
        $string4 = "SCREEN_VIEW_STOP"
        $string5 = "get_Jpeg"
        $string6 = "StopStress"
        $string7 = "SLOWLORIS"
        $string8 = "aforge" wide
        $string9 = "directshow" wide
        $string10 = "Imminent" wide
        $string11 = "firewall set opmode disable" wide

    condition:
        all of ($string*) and filesize > 400KB
}