Threadkit yara

different one by @cocaman

https://pastebin.com/wUfbF75w

rule Threadkit_new_rtf
{
    meta:
        author = " James_inthe_box"
        date = "2018/09"
        maltype = "Threadkit"

    strings:
        $sct1 = "2e736374" //sct
    	$sct2 = "2e536374" //Sct
    	$sct3 = "2e534374" //SCt
    	$sct4 = "2e534354" //SCT
    	$sct5 = "2e734354" //sCT
    	$sct6 = "2e736354" //scT
    	$sct7 = "2e536354" //ScT
    	$sct8 = "2e734374" //sCt

        $doc1 = "2e646f63" //doc
        $doc2 = "2e446f63" //Doc
        $doc3 = "2e444f63" //DOc
        $doc4 = "2e444f43" //DOC
        $doc5 = "2e644f43" //dOC
        $doc6 = "2e646f63" //doc
        $doc7 = "2e446f43" //DoC
        $doc8 = "2e644f63" //dOc

        $exe1 = "2e657865" // exe
        $exe2 = "2e457865" // Exe
        $exe3 = "2e455865" // EXe
        $exe4 = "2e455845" // EXE
        $exe5 = "2e655845" // eXE
        $exe6 = "2e657845" // exE
        $exe7 = "2e457845" // ExE
        $exe8 = "2e655865" // eXe

        $cmd1 = "2e636d64" // cmd
        $cmd2 = "2e436d64" // Cmd
        $cmd3 = "2e434d64" // CMd
        $cmd4 = "2e434d44" // CMD
        $cmd5 = "2e634d44" // cMD
        $cmd6 = "2e636d44" // cmD
        $cmd7 = "2e436d44" // CmD
        $cmd8 = "2e634d64" // cMd

    condition:
	    1 of ($sct*) and 1 of ($doc*) and 1 of ($exe*) and 1 of ($cmd*)
}

rule Threadkig_initial_rtf
{
    meta:
        author = " James_inthe_box"
        date = "2018/09"
        maltype = "Threadkit"

    strings:
        $sct1 = "2e736374" //sct
    	$sct2 = "2e536374" //Sct
    	$sct3 = "2e534374" //SCt
    	$sct4 = "2e534354" //SCT
    	$sct5 = "2e734354" //sCT
    	$sct6 = "2e736354" //scT
    	$sct7 = "2e536354" //ScT
    	$sct8 = "2e734374" //sCt

        $doc1 = "2e646f63" //doc
        $doc2 = "2e446f63" //Doc
        $doc3 = "2e444f63" //DOc
        $doc4 = "2e444f43" //DOC
        $doc5 = "2e644f43" //dOC
        $doc6 = "2e646f63" //doc
        $doc7 = "2e446f43" //DoC
        $doc8 = "2e644f63" //dOc

        $exe1 = "2e657865" // exe
        $exe2 = "2e457865" // Exe
        $exe3 = "2e455865" // EXe
        $exe4 = "2e455845" // EXE
        $exe5 = "2e655845" // eXE
        $exe6 = "2e657845" // exE
        $exe7 = "2e457845" // ExE
        $exe8 = "2e655865" // eXe

        $bat1 = "2e626174" // bat
        $bat2 = "2e426174" // Bat
        $bat3 = "2e424174" // BAt
        $bat4 = "2e424154" // BAT
        $bat5 = "2e624154" // bAT
        $bat6 = "2e626154" // baT
        $bat7 = "2e426154" // BaT
        $bat8 = "2e624174" // bAt

    condition:
	     1 of ($sct*) and 1 of ($doc*) and 1 of ($exe*) and 1 of ($bat*)
}