trat yara

http://update.wex-online.co/key.scr
http://5.188.231.235/rat.exe
http://domanname.bid/rat.exe
http://newsworldkind.stream/rat.exe

rule tRat_bin
{
    meta:
        description = "tRat"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/cd3d8d11-9bc5-44e4-b3b2-6325b808c273/"
        date = "2019/08"
        maltype = "RAT"

    strings:
        $string1 = "KL_START"
        $string2 = "&=O8"
        $string3 = "TJKeyLogger"
        $string4 = "tRat"
        $string5 = "Passwords.txt"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule tRat_mem
{
    meta:
        description = "tRat"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/cd3d8d11-9bc5-44e4-b3b2-6325b808c273/"
        date = "2019/08"
        maltype = "RAT"

    strings:
        $string1 = "KL_START"
        $string2 = "&=O8"
        $string3 = "TJKeyLogger"
        $string4 = "tRat"
        $string5 = "Passwords.txt"

    condition:
        all of ($string*) and filesize > 800KB
}