BlackNET Rat

rule Blacknet_bin
{
    meta:
        description = "Blacknet"
        author = "James_inthe_box"
        reference = "675ff919a86ea11619e81732137e7cc7b872cfbd5445e8db8d82d33f97bb1133"
        date = "2020/02"
        maltype = "RAT"

    strings:
        $string1 = "|BN|" ascii wide
        $string2 = "Online" ascii wide
        $string3 = "BlackNET.dat" ascii wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Blacknet_bin
{
    meta:
        description = "Blacknet"
        author = "James_inthe_box"
        reference = "675ff919a86ea11619e81732137e7cc7b872cfbd5445e8db8d82d33f97bb1133"
        date = "2020/02"
        maltype = "RAT"

    strings:
        $string1 = "|BN|" ascii wide
        $string2 = "Online" ascii wide
        $string3 = "BlackNET.dat" ascii wide

    condition:
        all of ($string*) and filesize > 800KB
}