Spytector yara

rule spytector_bin
{
    meta:
        description = "Spytector"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/57f39173-22bd-41c8-bbc1-2ce4ca7853d1"
        date = "2020/3"
        maltype = "Stealer"

    strings:
        $string1 = "FTPList"
        $string2 = "FTPSend"
        $string3 = "FirefoxRestore"
        $string4 = "%d.%d.%d build %d"
        $string5 = "hostname" wide
        $string6 = "sqlite3"
        $string7 = "No Hex-Number"
        $string8 = "YHTMLContainer"
        $string9 = "Internet Explorer_Server"
        $string10 = "com.apple.Safari"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule spytector_mem
{
    meta:
        description = "Spytector"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/57f39173-22bd-41c8-bbc1-2ce4ca7853d1"
        date = "2020/3"
        maltype = "Stealer"

    strings:
        $string1 = "FTPList"
        $string2 = "FTPSend"
        $string3 = "FirefoxRestore"
        $string4 = "%d.%d.%d build %d"
        $string5 = "hostname" wide
        $string6 = "sqlite3"
        $string7 = "No Hex-Number"
        $string8 = "YHTMLContainer"
        $string9 = "Internet Explorer_Server"
        $string10 = "com.apple.Safari"

    condition:
        all of ($string*) and filesize > 800KB
}

rule spytector_mem_simple
{
    meta:
        description = "Spytector"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/57f39173-22bd-41c8-bbc1-2ce4ca7853d1"
        date = "2020/3"
        maltype = "Stealer"

    strings:
       $simple1 = "spytector" ascii wide nocase

    condition:
        $simple1 and filesize > 800KB
}