BlacknixRAT snort suricata yara sig

rule BlacknixRAT_bin
{
    meta:
        description = "BlacknixRAT"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/e3d845db-09b5-462d-8290-cbb4bb4a505f/"
        date = "2019/02"
        maltype = "RAT"

    strings:
        $string1 = "[Random-Number-Here]"
        $string2 = "ScreenCapture"
        $string3 = "TScreenSpy"
        $string4 = "KeyLogger"
        $string5 = "RemoteShell"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 2000KB
}

alert tcp any any -> any 80 (msg:"Blacknix RAT Detected"; flow:established,to_server; content:"|32|"; depth:1; content:"|7c 78 01 6d 8e|"; within:10; reference:url,https://app.any.run/tasks/e3d845db-09b5-462d-8290-cbb4bb4a505f/; classtype:trojan-activity; sid:20166298; rev:1; metadata:created_at 2019_07_18;)