AES DDOS yara sig

rule AESDDOS_bin
{
    meta:
        description = "CloudDDOS"
        author = "James_inthe_box"
        reference = "3e617b40b552534565b24d43ace8c83711173256764f6c2b030ecfb582feeade"
        date = "2019/09"
        maltype = "Bot"

    strings:
        $string1 = "No such file or directory"
        $string2 = "No such device or address"
        $string3 = "@INFO:0.%d%%"
        $string4 = "Yow! Bad host lookup."

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 300KB
}

rule AESDDOS_mem
{
    meta:
        description = "CloudDDOS"
        author = "James_inthe_box"
        reference = "3e617b40b552534565b24d43ace8c83711173256764f6c2b030ecfb582feeade"
        date = "2019/09"
        maltype = "Bot"

    strings:
        $string1 = "No such file or directory"
        $string2 = "No such device or address"
        $string3 = "@INFO:0.%d%%"
        $string4 = "Yow! Bad host lookup."

    condition:
        all of ($string*) and filesize > 300KB
}