Ramnit cryptor

rule Ramnit_cryptor_bin
{
    meta:
        description = "Cryptor seen only with Ramint"
        author = "James_inthe_box"
        reference = "ead3f8379c51a7f14d045d2bd6a664a7a1a06322986d557c36ea26ea7d7ec37f"
        date = "2019/04"
        maltype = "Cryptor"

    strings:
        $string1 = /\\var\\www\\4test\\files\\cryptors\\admin\\Loc/

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 200KB
}

rule Ramnit_cryptor_mem
{
    meta:
        description = "Cryptor seen only with Ramint"
        author = "James_inthe_box"
        reference = "ead3f8379c51a7f14d045d2bd6a664a7a1a06322986d557c36ea26ea7d7ec37f"
        date = "2019/04"
        maltype = "Cryptor"

    strings:
        $string1 = /\\var\\www\\4test\\files\\cryptors\\admin\\Loc/

    condition:
        all of ($string*) and filesize > 200KB
}