Bifrost #yara sig

rule Bifrost_bin
{
    meta:
        description = "Bifrost"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/455e0ded-beff-4f9d-8174-b032ac50c6c6"
        date = "2019/08"
        maltype = "RAT"

    strings:
        $string1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
        $string2 = "TFloodParams"
        $string3 = "Range:bytes="
        $string4 = "Host:"
        $string5 = "Connection: keep-alive"
        $string6 = "User-Agent:"
        $string7 = "Content-Length:"
        $string8 = "Referer:"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Bifrost_mem
{
    meta:
        description = "Bifrost"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/455e0ded-beff-4f9d-8174-b032ac50c6c6"
        date = "2019/08"
        maltype = "RAT"

    strings:
        $string1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
        $string2 = "TFloodParams"
        $string3 = "Range:bytes="
        $string4 = "Host:"
        $string5 = "Connection: keep-alive"
        $string6 = "User-Agent:"
        $string7 = "Content-Length:"
        $string8 = "Referer:"

    condition:
        all of ($string*) and filesize > 800KB
}