AveMaria yara

rule AveMaria_bin_mem
{
    meta:
        description = "AveMaria infostealer"
        author = " James_inthe_box"
        reference = "https://app.any.run/tasks/67362469-76df-4b19-bfda-5d95a2b4d179"
        date = "2018/12"
        maltype = "Infotealer"

    strings:
        $string1 = "127.0.0.2"
        $string2 = "profiles.ini" wide
        $string3 = "AVE_MARIA"
        $string4 = "MortyCrypter" wide

    condition:
        all of ($string*)
}