Azorult yara

rule Azorult
{
    meta:
        author = " James_inthe_box"
        date = "2018/10"
        maltype = "Azorult"

    strings:
        $string1 = ".tmp" wide
        $strings = "</account>"
        $string3 = "</jid>" wide
        $string4 = "PsiPlus"
        $string5 = "</account>"

    condition:
        all of them
}