Rules updated to be more focused on the malware as requested

malware/RAT_PoetRATDoc.yar

@@ -6,12 +6,20 @@ rule PoetRat
         Data = "6th May 2020"
     strings:
         $pythonRegEx = /(\.py$|\.pyc$|\.pyd$|Python)/  // checking for python strings
+
+        // Python file strings in the word documents
+        $pythonFile1 = "launcher.py"
+        $zipFile = "smile.zip"
+        $pythonFile2 = "smile_funs.py"
+        $pythonFile3 = "frown.py"
+        $pythonFile4 = "backer.py"
+        $pythonFile5 = "smile.py"
+        $pythonFile6 = "affine.py" 
+
+        // dlls and cmd strings
         $dlls = /\.dll/
         $cmd = "cmd"
-        $exe = ".exe"
-        $macro1 = "document_open"
-        $pipe_out = "Abibliophobia23"
-        $shot = "shot_{0}_{1}.png"
+        $exe = ".exe"   
     condition:
-    any of them        
+    all of them        
 }
\ No newline at end of file

malware/RAT_PoetRATPython.yar

@@ -5,11 +5,15 @@ rule PoetRat
         Description = "A yara rule to catch PoetRat python scripts"
         Data = "6th May 2020"
     strings:
+
+        // Any of the strings that stand out in the files, these are for the multiple python files, not just for a single file
         $encrptionFunction = "Affine"
         $commands = /version|ls|cd|sysinfo|download|upload|shot|cp|mv|link|register|hid|compress|jobs|exit|tasklist|taskkill/
         $domain = "dellgenius.hopto.org"
         $grammer_massacre = /BADD|Bad Error Happened|/
         $mayBePresent = /self\.DIE|THE_GUID_KEY/
+        $pipe_out = "Abibliophobia23"
+        $shot = "shot_{0}_{1}.png"
     condition:
     any of them        
 }
\ No newline at end of file