Merge pull request #373 from Nishan8583/master

Poet Rat Rules

malware/RAT_PoetRATDoc.yar

+rule PoetRat
+{
+    meta:
+        Author = "Nishan Maharjan"
+        Description = "A yara rule to catch PoetRat Word Document"
+        Data = "6th May 2020"
+    strings:
+        $pythonRegEx = /(\.py$|\.pyc$|\.pyd$|Python)/  // checking for python strings
+
+        // Python file strings in the word documents
+        $pythonFile1 = "launcher.py"
+        $zipFile = "smile.zip"
+        $pythonFile2 = "smile_funs.py"
+        $pythonFile3 = "frown.py"
+        $pythonFile4 = "backer.py"
+        $pythonFile5 = "smile.py"
+        $pythonFile6 = "affine.py" 
+
+        // dlls and cmd strings
+        $dlls = /\.dll/
+        $cmd = "cmd"
+        $exe = ".exe"   
+    condition:
+    all of them        
+}
\ No newline at end of file

malware/RAT_PoetRATPython.yar

+rule PoetRat
+{
+    meta:
+        Author = "Nishan Maharjan"
+        Description = "A yara rule to catch PoetRat python scripts"
+        Data = "6th May 2020"
+    strings:
+
+        // Any of the strings that stand out in the files, these are for the multiple python files, not just for a single file
+        $encrptionFunction = "Affine"
+        $commands = /version|ls|cd|sysinfo|download|upload|shot|cp|mv|link|register|hid|compress|jobs|exit|tasklist|taskkill/
+        $domain = "dellgenius.hopto.org"
+        $grammer_massacre = /BADD|Bad Error Happened|/
+        $mayBePresent = /self\.DIE|THE_GUID_KEY/
+        $pipe_out = "Abibliophobia23"
+        $shot = "shot_{0}_{1}.png"
+    condition:
+    any of them        
+}
\ No newline at end of file