Netwire alt

rule NetWire_exe_memory
{
    meta:
        author = " James_inthe_box"
        date = "2018/10"
        maltype = "Netwire_alt"

    strings:

        $string1 = "%.2d-%.2d-%.4d"
        $string2 = "%s%.2d-%.2d-%.4d"
        $string3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
        $string4 = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
        $string5 = "Password"

    condition:
        all of them
}