Mohaza bot yara sig

rule Mohazo_bot_bin
{
    meta:
        description = "Mohazo bot stealer"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/411a4cce-783c-4d3f-a57e-eb0c86de4e00"
        date = "2019/04"
        maltype = "Bot"

    strings:
        $string1 = "content-disposition: form-data; name=\""
        $string2 = "%[^:]"
        $string3 = "%99[^:]"
        $string4 = "loader_urls"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Mohazo_bot_mem
{
    meta:
        description = "Mohazo bot stealer"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/411a4cce-783c-4d3f-a57e-eb0c86de4e00"
        date = "2019/04"
        maltype = "Bot"

    strings:
        $string1 = "content-disposition: form-data; name=\""
        $string2 = "%[^:]"
        $string3 = "%99[^:]"
        $string4 = "loader_urls"

    condition:
        all of ($string*) and filesize > 800KB
}