Flawedammyy yara

rule Flawedammyy_bin
{
    meta:
        description = "Flawed Ammyy RAT"
        author = "James_inthe_box"
        reference = "84259a3c6fd62a61f010f972db97eee69a724020af39d53c9ed1e9ecefc4b6b6"
        date = "2019/02"
        maltype = "RAT"

    strings:
        $mz = { 4d 5a }
        $string1 = "service.log" wide
        $string2 = "readme!!!.txt" wide
        $string3 = "Global\\Ammyy.Service" wide
        $string4 = "Ammyy Admin"

    condition:
        uint16(0) == 0x5A4D and uint8(uint32(0x3c)+23) == 0x21 and all of ($string*) and filesize < 800KB
}

rule Flawedammyy_mem
{
    meta:
        description = "Flawed Ammyy RAT"
        author = "James_inthe_box"
        reference = "84259a3c6fd62a61f010f972db97eee69a724020af39d53c9ed1e9ecefc4b6b6"
        date = "2019/02"
        maltype = "RAT"

    strings:
        $string1 = "service.log" wide
        $string2 = "readme!!!.txt" wide
        $string3 = "Global\\Ammyy.Service" wide
        $string4 = "Ammyy Admin"

    condition:
        all of ($string*) and filesize > 800KB
}