Truebot yara sig

rule TrueBot_bin
{
    meta:
        description = "TrueBot"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/131c3342-3edb-497a-a6dc-57975603ccc0/"
        date = "2019/02"
        maltype = "Loader"

    strings:
        $string1 = "api-ms-win-" wide
        $string2 = "Tntdll.dll" wide
        $string3 = "Content-Type: multipart/form-data; boundary=----qwerty"
        $string4 = "n=%x&o=%s&a=%d"
        $string5 = "%s\\temps.dat"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 200KB
}

rule TrueBot_mem
{
    meta:
        description = "TrueBot"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/131c3342-3edb-497a-a6dc-57975603ccc0/"
        date = "2019/02"
        maltype = "Loader"

    strings:
        $string1 = "api-ms-win-" wide
        $string2 = "Tntdll.dll" wide
        $string3 = "Content-Type: multipart/form-data; boundary=----qwerty"
        $string4 = "n=%x&o=%s&a=%d"
        $string5 = "%s\\temps.dat"

    condition:
        all of ($string*) and filesize > 200KB
}