Retefe yara sig

rule Retefe_mem
{
    meta:
        description = "Retefe"
        author = " James_inthe_box"
        reference = "https://app.any.run/tasks/e12aee8f-c137-4002-859c-cedc675c8536"
        date = "2018/12"
        maltype = "Banker"

    strings:
        $string1 = "http://127.0.0.1:5555"
        $string2 = "socat-windows"
        $string3 = "torbrowser"
        $string4 = "taskscheduler"
        $string5 = "chocolatey"
        $string6 = "SOCKS4A:127.0.0.1"

    condition:
        all of ($string*)
}

rule Retefe_js
{
    meta:
        description = "Retefe"
        author = " James_inthe_box"
        reference = "https://app.any.run/tasks/e12aee8f-c137-4002-859c-cedc675c8536"
        date = "2018/12"
        maltype = "Banker"

    strings:
        $string1 = "http://127.0.0.1:5555/{0}.js?ip={1}"
        $string2 = ".onion"
        $string3 = "icanhazip.com"
        $string4 = "api.ipify.org"
        $string5 = "\\\\root\\\\cimv2"

    condition:
        all of ($string*)
}