Crisis

rule crisisht_mem
{
    meta:
        description = "Crisis from Hacking Team"
        author = "James_inthe_box"
        reference = "76840fa18df8764afb51f1aa6da10ff65f1bdfe434dc988917380fa31fbe3a73"
        date = "2020/01"
        maltype = "RAT"

    strings:
        $string1 = "SHOT@" ascii wide
        $string2 = { 7b 22 63 61 6d 65 72 61 22 3a 7b 22 65 6e 61 62 6c 65 64 22 }
        $string3 = { 22 73 63 72 65 65 6e 73 68  6f 74 22 3a 7b 22 65 6e 61 62 6c 65 64 22 3a 66 }

    condition:
        all of ($string*)
}