Cassandra protector yara

rule CyaX_Sharp_bin
{
    meta:
        description = "Cassanda CyaX packer"
        author = "James_inthe_box"
        reference = ""
        date = "2020/02"
        maltype = "Packer"

    strings:
        $string1 = "CyaX_Sharp" ascii wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 2800KB
}