Rietspoof yara

rule Rietspoof_bin
{
    meta:
        description = "Rietspoof bot"
        author = "James_inthe_box"
        reference = "https://blog.avast.com/rietspoof-malware-increases-activity"
        date = "2019/02"
        maltype = "Downloader"

    strings:
        $mz = { 4d 5a }
        $string1 = "RAM:"
        $string2 = "CPU:"
        $string3 = "USER: admin"
        $string4 = "USER: user"
        $string5 = "data.dat"

    condition:
        ($mz at 0) and (all of ($string*)) and filesize < 3MB
}

rule Rietspoof_mem
{
    meta:
        description = "Rietspoof bot"
        author = "James_inthe_box"
        reference = "https://blog.avast.com/rietspoof-malware-increases-activity"
        date = "2019/02"
        maltype = "Downloader"

    strings:
        $string1 = "RAM:"
        $string2 = "CPU:"
        $string3 = "USER: admin"
        $string4 = "USER: user"
        $string5 = "data.dat"

    condition:
        all of ($string*) and filesize > 100KB
}