IcedID loader yara

rule IcedID_newloader_bin
{
    meta:
        description = "IcedID Loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/16c7bbfb-1c6a-40be-a625-bf8bc870354b/"
        date = "2020/03"
        maltype = "Loader"

    strings:
        $string1 = "; _gat=" wide
        $string2 = "; _ga=" wide
        $string3 = "; _u=" wide
        $string4 = "; __io=" wide
        $string5 = "; _gid=" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
}

rule IcedID_newloader_mem
{
    meta:
        description = "IcedID Loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/16c7bbfb-1c6a-40be-a625-bf8bc870354b/"
        date = "2020/03"
        maltype = "Loader"

    strings:
        $string1 = "; _gat=" wide
        $string2 = "; _ga=" wide
        $string3 = "; _u=" wide
        $string4 = "; __io=" wide
        $string5 = "; _gid=" wide

    condition:
        all of ($string*) and filesize > 100KB
}