Raccoon stealer yara sig

rule Raccoon_stealer_bin
{
    meta:
        description = "Raccoon Stealer"
        author = "James_inthe_box"
        reference = "161e393d9f16ea79c1d8356ec926f5bbf11568f5a322f1cd7216bcd12b4d2091"
        date = "2019/09"
        maltype = "Stealer"

    strings:
        $string1 = "attachment_url"
        $string2 = "loader_urls"
        $string3 = "[^:]://"
        $string4 = "POST" ascii wide
        $string5 = "SUBTYPE GUID="
        $string6 = "rg:\\stealer\\stealler\\json.hpp" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Raccoon_stealer_mem
{
    meta:
        description = "Raccoon Stealer"
        author = "James_inthe_box"
        reference = "161e393d9f16ea79c1d8356ec926f5bbf11568f5a322f1cd7216bcd12b4d2091"
        date = "2019/09"
        maltype = "Stealer"

    strings:
        $string1 = "attachment_url"
        $string2 = "loader_urls"
        $string3 = "[^:]://"
        $string4 = "POST" ascii wide
        $string5 = "SUBTYPE GUID="
        $string6 = "rg:\\stealer\\stealler\\json.hpp" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize > 800KB
}