Blackrat yara sig

rule Blackrat_bin
{
    meta:
        description = "Blackrat"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/df948de2-bd4f-431e-a4d8-dde5a17b9ff4"
        date = "2019/11"
        maltype = "RAT"

    strings:
        $string1 = "BC02.My"
        $string2 = "f3LrqnzkqCDx23N0zbGC"
        $string3 = "c8c8c4c4-b531-4925-8c71-925d272d2411"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Blackrat_mem
{
    meta:
        description = "Blackrat"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/df948de2-bd4f-431e-a4d8-dde5a17b9ff4"
        date = "2019/11"
        maltype = "RAT"

    strings:
        $string1 = "BC02.My"
        $string2 = "f3LrqnzkqCDx23N0zbGC"
        $string3 = "c8c8c4c4-b531-4925-8c71-925d272d2411"

    condition:
        all of ($string*) and filesize > 800KB
}