Pitou yara sig

rule Pitou_bin
{
    meta:
        description = "Pitou"
        author = "James_inthe_box"
        reference = "https://isc.sans.edu/diary/25068"
        date = "2019/06"
        maltype = "Spammer"

    strings:
        $string1 = "explorer.exe" wide
        $string2 = "Elevation:Administrator!new:" wide
        $string3 = "EFI PART"
        $string4 = "\\\\.\\C:"
        $string5 = "\\\\.\\PHYSICALDRIVE0"
        $string6 = ".pdb"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Pitou_mem
{
    meta:
        description = "Pitou"
        author = "James_inthe_box"
        reference = "https://isc.sans.edu/diary/25068"
        date = "2019/06"
        maltype = "Spammer"

    strings:
        $string1 = "explorer.exe" wide
        $string2 = "Elevation:Administrator!new:" wide
        $string3 = "EFI PART"
        $string4 = "\\\\.\\C:"
        $string5 = "\\\\.\\PHYSICALDRIVE0"
        $string6 = ".pdb"

    condition:
        all of ($string*) and filesize > 800KB
}