ArtraDownloader yara sig

rule ArtraDownlaoder_bin
{
    meta:
	description = "Artra Downloader"
        author = "James_inthe_box"
	reference = "dcb8531b0879d46949dd63b1ac094f5588c26867805d0795e244f4f9b8077ed1"
        date = "2019/08"
        maltype = "Loader"

    strings:
        $string1 = "bqqmjdbujpo0y.xxx.gpsn.vsmfodpefe"
	$string2 = "=%s&st=%d"
        $string4 = "Content-length: %d"
        $string5 = "0I0N0V0\\0o0v0"
        $string6 = "ID=%s"

    condition:
	uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
}

rule ArtraDownlaoder_mem
{
    meta:
        description = "Artra Downloader"
        author = "James_inthe_box"
        reference = "dcb8531b0879d46949dd63b1ac094f5588c26867805d0795e244f4f9b8077ed1"
        date = "2019/08"
        maltype = "Loader"

    strings:
        $string1 = "bqqmjdbujpo0y.xxx.gpsn.vsmfodpefe"
        $string2 = "=%s&st=%d"
        $string4 = "Content-length: %d"
        $string5 = "0I0N0V0\\0o0v0"
        $string6 = "ID=%s"

    condition:
        all of ($string*) and filesize > 100KB
}