DCRat yara

rule DCRat_bin
{
    meta:
        description = "DCRat"
        author = "James_inthe_box"
        reference = "8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95"
        date = "2019/09"
        maltype = "RAT"

    strings:
        $string1 = "DCRatBuild"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 3000KB
}

rule DCRat_mem
{
    meta:
        description = "DCRat"
        author = "James_inthe_box"
        reference = "8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95"
        date = "2019/09"
        maltype = "RAT"

    strings:
        $string1 = "DCRatBuild"

    condition:
        all of ($string*) and filesize > 3000KB
}