YARA Example Hex Rule

import "pe"

rule Echelon : echelon stealer dotnet
{
    meta:
        author = "Stephan Simon <[email protected]>"
        date = "2020-07-30"
        description = "An example YARA rule for learning how to use code-based hexadecimal rules"
        modified = "2020-07-30"
        hash = "b52d4177277851b95c5cdf08bf2e3261c7ac80af449da00741c83bcf6c181d67"
        tlp = "WHITE"
    strings:
        $main_1 = { 00 7E [4] 72 [4] 7E [4] 28 [4] 28 [4] 0B 07 2C }
        $main_2 = { 00 7E [4] 72 [4] 7E [4] 28 [4] 28 [4] 7E [4] 6F [4] 16 FE 01 0C 08 2C }
        $configuration = { 72 [4] 80 [4] 72 [4] 80 [4] 72 [4] 80 [4] 20 [4] 80 [4] (1? | 20 ?? ?? ?? ??) 8D [4] 25 16 72 [4] A2 }
    condition:
        uint16(0) == 0x5a4d
        and filesize <= 1MB
        and pe.imports("mscoree.dll")
		and (
			$configuration
			or 2 of ($main_*)
		)
}