Danabot test yara

rule Danabot
{
    meta:
        author = " James_inthe_box"
        date = "2018/09"
        maltype = "Danabot"

    strings:
        $string1 = "SOFTWARE\\Far\\Plugins\\FTP\\Hosts" wide
        $string2 = "FAR Manager FTP" wide
        $string3 = "Software\\CoffeeCup Software\\Internet\\Proxy" wide
        $string4 = "\\FTPRush\\RushSite.xml" wide
        $string5 = "\\BitKinex\\bitkinex.ds" wide
        $string6 = "ExpanDrive" wide
        $string7 = "\\GPSoftware\\Directory Opus\\ConfigFiles\\ftp.oxc" wide
        $string8 = "Software\\South River Technologies\\WebDrive\\Connections" wide
        $string9 = "Software\\ORL\\WinVNC3" wide
        $string10 = "CamFrogMCU" wide
        $string11 = "MuxaSoft Dialer" wide
        /*
        $string12 = "SELECT GlobalValue FROM \"TGlobalSettings\" WHERE GlobalName=\"MagicNumber\""
        $string13 = "SELECT ServerName, Url, ServerUser, ServerPass, RemoteDir FROM \"TServers\""
        */

    condition:
        all of ($string*)
}