MedusaHTTP yara

rule Medusa_mem
{
    meta:
        description = "MedusaHTTP"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/68c8f400-eba5-4d6c-b1f1-8b07d4c014a4"
        date = "2019/08"
        maltype = "DDOS"

    strings:
        $string1 = "MacAddress"
        $string2 = "Internal.log"
        $string3 = "Failed"
        $string4 = "POST!"
        $string5 = "abc="
        $string6 = "xyz="
        $string7 = "slavicdragon"
        $string8 = "smartflood"

    condition:
        all of ($string*) and filesize > 800KB
}