uPELoader yara

rule uPELoader_bin
{
    meta:
        description = "uPELoader"
        author = "James_inthe_box"
        reference = "ad83235d5eb8802283d0e7a10ddf0733dc3d5356d3f96eee42c1289d862c378c"
        date = "2019/01"
        maltype = "Loader"

    strings:
        $mz = { 4d 5a }
        $string1 = "z_stream"
        $string2 = "Win_Set_Info_Gad"
        $string3 = "Win_Run_Map_Gad"
        $string4 = ";uPELoader"
        $string5 = "SSEncrypt"

    condition:
        ($mz at 0) and (all of ($string*)) and filesize < 400KB
}

rule uPELoader_mem
{
    meta:
        description = "uPELoader"
        author = "James_inthe_box"
        reference = "ad83235d5eb8802283d0e7a10ddf0733dc3d5356d3f96eee42c1289d862c378c"
        date = "2019/01"
        maltype = "Loader"

    strings:
        $string1 = "z_stream"
        $string2 = "Win_Set_Info_Gad"
        $string3 = "Win_Run_Map_Gad"
        $string4 = ";uPELoader"
        $string5 = "SSEncrypt"

    condition:
        all of ($string*) and filesize > 400KB
}