Agenttesla new yara

rule Agenttesla_new_bin_mem
{
    meta:
	author = "James_inthe_box"
	reference = "https://app.any.run/tasks/7d26c900-f772-4697-8bec-0c24f29e317c"
	date = "2019/01"
	maltype = "Infotealer"

    strings:
        $string1 = "Password could not decrypted." wide
	$string2 = "hostname|encryptedPassword|encryptedUsername" wide
	$string3 = "firefox.exe" wide
	$string4 = "IELibrary.dll"
	$string5 = "PROGRAMFILES" wide

    condition:
        all of ($string*)
}