VNCOLD yara sig

rule Vncold_hvnc_memory
{
        meta:
                author = "James_inthe_box"
                date = "2018/09"
                maltype = "Stealer"

        strings:
                $string1 = "(%S)_%08x-VNCOLD"
                $string2 = "#hvnc"

        condition:
                all of them
}