MoDi RAT yara

rule modi_bin
{
    meta:
        description = "MoDi rat"
        author = "James_inthe_box"
        reference = "f9eec7fda9e8d5001161a20f325c207014e3f08ee6bef533587eac651afc3e36"
        date = "2020/03"
        maltype = "RAT"

    strings:
        $name1 = "MoDi RAT" ascii wide
        $string1 = "add_Connected" ascii wide
        $string2 = "ServerComputer" ascii wide
        $string3 = "add_Disconnected" ascii wide
        $string4 = "IsBuzy" ascii wide
        $string5 = "remove_Data"

    condition:
        uint16(0) == 0x5A4D and (all of ($string*) or $name1) and filesize < 200KB
}

rule modi_mem
{
    meta:
        description = "MoDi rat"
        author = "James_inthe_box"
        reference = "f9eec7fda9e8d5001161a20f325c207014e3f08ee6bef533587eac651afc3e36"
        date = "2020/03"
        maltype = "RAT"

    strings:
        $name1 = "MoDi RAT" ascii wide
        $string1 = "add_Connected" ascii wide
        $string2 = "ServerComputer" ascii wide
        $string3 = "add_Disconnected" ascii wide
        $string4 = "IsBuzy" ascii wide
        $string5 = "remove_Data"

    condition:
        (all of ($string*) or $name1) and filesize > 200KB
}

rule cryptage_larbi_bin
{
    meta:
        description = "MoDi rat loader"
        author = "James_inthe_box"
        reference = "c6f3139e24ca5a0d7e21b7ee6128142e36daffac4cd8d9a89c191dc823f099ab"
        date = "2020/03"
        maltype = "RAT"

    strings:
        $name1 = "Cryptage VBE" ascii wide fullword
        $name2 = "Project Larbi" ascii wide fullword

    condition:
        uint16(0) == 0x5A4D and any of ($name*) and filesize < 200KB
}

rule cryptage_larbi_mem
{
    meta:
        description = "MoDi rat loader"
        author = "James_inthe_box"
        reference = "c6f3139e24ca5a0d7e21b7ee6128142e36daffac4cd8d9a89c191dc823f099ab"
        date = "2020/03"
        maltype = "RAT"

    strings:
        $name1 = "Cryptage VBE" ascii wide fullword
        $name2 = "Project Larbi" ascii wide fullword

    condition:
        any of ($name*) and filesize > 200KB
}