reactor.yara

import "dotnet"
rule net_reactor_obfuscated {
    strings:
        $s1 = "#GUlD" fullword
        $s2 = "#GUID" fullword
        $s3 = "#Blop" fullword
        $s4 = "#Blob" fullword
    condition:
        dotnet.is_dotnet and all of them
}