Bandook yara sig

rule Bandook_bin
{
    meta:
        description = "Bandook rat"
        author = "James_inthe_box"
        reference = "059296ebba9ab44684cf4af6ef19185b24584bc0a6c9efe1089d3cc022d689c2"
        date = "2019/04"
        maltype = "RAT"

    strings:
        $string1 = "<ellipsis>"
        $string2 = "https://wtfismyip.com/text"
        $string3 = "SELECT * FROM AntiVirusProduct"
        $string4 = "%s~!"
        $string5 = "TEST" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 1000KB
}

rule Bandook_mem
{
    meta:
        description = "Bandook rat"
        author = "James_inthe_box"
        reference = "059296ebba9ab44684cf4af6ef19185b24584bc0a6c9efe1089d3cc022d689c2"
        date = "2019/04"
        maltype = "RAT"

    strings:
        $string1 = "<ellipsis>"
        $string2 = "https://wtfismyip.com/text"
        $string3 = "SELECT * FROM AntiVirusProduct"
        $string4 = "%s~!"
        $string5 = "TEST" wide

    condition:
        all of ($string*) and filesize > 1000KB
}