ServSelper

rule Servhelper_comms_mem
{
    meta:
        description = "ServSelper"
        author = " James_inthe_box"
        reference = "https://app.any.run/tasks/78d05d2e-368d-4849-88b3-f71254d37fc5"
        date = "2018/12"
        maltype = "RAT"

    strings:
        $string1 = "key"
        $string2 = "&sysid="
        $string3 = "&resp="

    condition:
        all of ($string*)
}

rule Servhelper_mem
{
    meta:
        description = "ServSelper"
        author = " James_inthe_box"
        reference = "https://app.any.run/tasks/78d05d2e-368d-4849-88b3-f71254d37fc5"
        date = "2018/12"
        maltype = "RAT"

    strings:
        $string1 = "/c ping localhost -n 30 > nul & del" wide
        $string2 = "System.Net.HttpClient.THTTPClient"
        $string3 = "cmd.exe" wide
        $string4 = "selfkill" wide
        $string5 = "key=" wide
        $string6 = "sysid=" wide
        $string7 = "resp=" wide
        $string8 = "username" wide

    condition:
        all of ($string*)
}