Parallax rat yara

rule Parallax_bin
{
    meta:
        description = "Parallax RAT"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/2c605bca-dd95-45fc-a8a7-79a915d2b798"
        date = "2019/12"
        maltype = "RAT"

    strings:
        $string1 = "image/jpeg" wide ascii
        $string2 = "[Ctrl]" wide ascii
        $string4 = "Clipboard End" wide ascii
        $string5 = "UN.vbs" wide ascii
        $string6 = "DeleteFile(Wscript.ScriptFullName)" wide ascii
        $string8 = "Clipboard Start" wide ascii
        $string9 = "[Alt]" wide ascii

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 200KB
}

rule Parallax_mem
{
    meta:
        description = "Parallax RAT"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/2c605bca-dd95-45fc-a8a7-79a915d2b798"
        date = "2019/12"
        maltype = "RAT"

    strings:
        $string1 = "image/jpeg" wide ascii
        $string2 = "[Ctrl]" wide ascii
        $string4 = "Clipboard End" wide ascii
        $string5 = "UN.vbs" wide ascii
        $string6 = "DeleteFile(Wscript.ScriptFullName)" wide ascii
        $string8 = "Clipboard Start" wide ascii
        $string9 = "[Alt]" wide ascii

    condition:
        all of ($string*) and filesize > 200KB
}

rule Parallax_mem_loose
{
    meta:
        description = "Parallax RAT"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/2c605bca-dd95-45fc-a8a7-79a915d2b798"
        date = "2019/12"
        maltype = "RAT"

    strings:
        $string1 = "image/jpeg" wide ascii
        $string2 = "[Ctrl]" wide ascii
        $string4 = "Clipboard End" wide ascii
        $string5 = "UN.vbs" wide ascii
        $string6 = "DeleteFile(Wscript.ScriptFullName)" wide ascii
        $string8 = "Clipboard Start" wide ascii
        $string9 = "[Alt]" wide ascii

    condition:
        4 of ($string*) and filesize > 200KB
}