Agenttesla extracted

rule AgentTesla_extracted_bin_mem
{
    meta:
        description = "AgentTesla extracted"
        author = "James_inthe_box"
        reference = "a30b4ca960f559c6f8bf834729da77a4"
        date = "2020/"
        maltype = "keylogger"
    strings:
        $string1 = "Berkelet DB" wide
        $string2 = "kbHook" ascii
        $string3 = "logins" wide
        $string4 = "My.Computer"
    condition:
        all of ($string*)
}