Kewgad yara sig

rule phantom_nugget_bin
{
    meta:
	description = "Unknown"
        author = "James_inthe_box"
		reference = "https://app.any.run/tasks/172f39cc-4ae1-4e66-97da-f631ce45dc87"
        date = "2019/01"
        maltype = "Unknown"

    strings:
	$mz = { 4d 5a }
        $string1 = "@TaskGuid"
		$string2 = "@ExecSign"
        $string3 = "@TaskSign"
        $string4 = "@NameID@"
        $string5 = "@DefGad@"
        $string6 = "@NetKey@"
        $string7 = "@SerUrlJM@"
        $string8 = "@SerNewIP@"

    condition:
	($mz at 0) and (all of ($string*)) and filesize < 400KB
}

rule phantom_nugget_mem
{
    meta:
        description = "Unknown"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/172f39cc-4ae1-4e66-97da-f631ce45dc87"
        date = "2019/01"
        maltype = "Unknown"

    strings:
        $string1 = "@TaskGuid"
        $string2 = "@ExecSign"
        $string3 = "@TaskSign"
        $string4 = "@NameID@"
        $string5 = "@DefGad@"
        $string6 = "@NetKey@"
        $string7 = "@SerUrlJM@"
        $string8 = "@SerNewIP@"

    condition:
        all of ($string*) and filesize > 400KB
}