Osiris yara sig

rule Osiris_bin
{
    meta:
        description = "Osiris"
        author = "James_inthe_box"
        reference = "0325714eeb2af235a0f543ad9e11b5d852a61be78c9ece308c651412d97edd39"
        date = "2019/08"
        maltype = "Banker"

    strings:
        $string1 = "MAKEITSAD"
        $string2 = "%s\\%d-%02d-%02d_%02d-%02d-%02d_%d.dat" wide
        $string3 = "has_existing.txt" wide
        $string4 = "LibVNCServer"
        $string5 = "BOTID"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Osiris_mem
{
    meta:
        description = "Osiris"
        author = "James_inthe_box"
        reference = "0325714eeb2af235a0f543ad9e11b5d852a61be78c9ece308c651412d97edd39"
        date = "2019/08"
        maltype = "Banker"

    strings:
        $string1 = "MAKEITSAD"
        $string2 = "%s\\%d-%02d-%02d_%02d-%02d-%02d_%d.dat" wide
        $string3 = "has_existing.txt" wide
        $string4 = "LibVNCServer"
        $string5 = "/kpanel/"
        $string6 = "Fast Guard"
        $string7 = "BOTID"

    condition:
        all of ($string*) and filesize > 800KB
}