IModuleGetter snort suricata yara

alert tcp $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"IModuleGetter Loader Detected"; flow:established,to_server; content:"net|2e|tcp"; fast_pattern; content:"IModuleGetter"; reference:url,https://app.any.run/tasks/f435d89d-30a5-465b-8a8d-b7a042665e0e; classtype:trojan-activity; sid:20166290; rev:1; metadata:created_at 2019_03_24;)

rule IModuleGetter_bin
{
    meta:
        description = "IModuleGetter loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/f435d89d-30a5-465b-8a8d-b7a042665e0e"
        date = "2019/03"
        maltype = "Loader"

    strings:
        $string1 = "System.Xml"
        $string2 = "IModuleGetter"
        $string3 = "XmlDictionaryReaderQuotas"
        $string4 = "%USERPROFILE%\\AppData\\Local\\Temp\\NetPlatform" wide
        $string5 = "_settings" wide
        $string6 = "net.tcp://{0}:23566/IModuleGetter" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
}

rule IModuleGetter_mem
{
    meta:
        description = "IModuleGetter loader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/f435d89d-30a5-465b-8a8d-b7a042665e0e"
        date = "2019/03"
        maltype = "Loader"

    strings:
        $string1 = "System.Xml"
        $string2 = "IModuleGetter"
        $string3 = "XmlDictionaryReaderQuotas"
        $string4 = "%USERPROFILE%\\AppData\\Local\\Temp\\NetPlatform" wide
        $string5 = "_settings" wide
        $string6 = "net.tcp://{0}:23566/IModuleGetter" wide

    condition:
        all of ($string*) and filesize > 100KB
}