CN GUI Scanner Tool Yara Rule

rule CN_GUI_Scanner {
    meta:
        description = "Detects an unknown GUI scanner tool - CN background"
        author = "Florian Roth"
        hash = "3c67bbb1911cdaef5e675c56145e1112"
        score = 65
        date = "04.10.2014"
    strings:
        $s1 = "good.txt" fullword ascii
        $s2 = "IP.txt" fullword ascii
        $s3 = "xiaoyuer" fullword ascii
        $s0w = "ssh(" fullword wide
        $s1w = ").exe" fullword wide
    condition:
        all of them
}