DNSpionage yara

rule DNSpionage_bin_mem
{
    meta:
        author = " James_inthe_box"
        date = "2018/12"
        maltype = "DNSpionage"

    strings:
        $string1 = "/Client/Login?id="
        $string2 = "commands:"
        $string3 = "Downloads"
        $string4 = "Uploads"
        $string5 = "Apps"

    condition:
        all of ($string*)
}