Poet Rat Rules

malware/RAT_PoetRATDoc.yar

+rule PoetRat
+{
+    meta:
+        Author = "Nishan Maharjan"
+        Description = "A yara rule to catch PoetRat Word Document"
+        Data = "6th May 2020"
+    strings:
+        $pythonRegEx = /(\.py$|\.pyc$|\.pyd$|Python)/  // checking for python strings
+        $dlls = /\.dll/
+        $cmd = "cmd"
+        $exe = ".exe"
+        $macro1 = "document_open"
+        $pipe_out = "Abibliophobia23"
+        $shot = "shot_{0}_{1}.png"
+    condition:
+    any of them        
+}
\ No newline at end of file

malware/RAT_PoetRATPython.yar

+rule PoetRat
+{
+    meta:
+        Author = "Nishan Maharjan"
+        Description = "A yara rule to catch PoetRat python scripts"
+        Data = "6th May 2020"
+    strings:
+        $encrptionFunction = "Affine"
+        $commands = /version|ls|cd|sysinfo|download|upload|shot|cp|mv|link|register|hid|compress|jobs|exit|tasklist|taskkill/
+        $domain = "dellgenius.hopto.org"
+        $grammer_massacre = /BADD|Bad Error Happened|/
+        $mayBePresent = /self\.DIE|THE_GUID_KEY/
+    condition:
+    any of them        
+}
\ No newline at end of file