Unpacked GolRoted/HawkEye Keylogger Yara Rule

gistfile1.txt

rule MSIL_GolRoted_Hawkeye_Unpacked {
        meta:
                description = "Detect Unpacked GolRoted/HawkEye Keylogger"
                author = "@seanmw"
                date = "2015-06-02"
        strings:
                $s1 = "encryptedemailstring" fullword ascii
                $s2 = "encryptedpassstring" fullword ascii
                $s3 = "encryptedsmtpstring" fullword ascii
                $s4 = "encryptedftphost" fullword ascii
                $s5 = "encryptedftpuser" fullword ascii
                $s6 = "encryptedftppass" fullword ascii
                $s7 = "encryptedemailstring" fullword ascii
                $s8 = ":\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" fullword wide
                $s9 = "http://whatismyipaddress.com/" fullword wide
                $s10 = "Operating System Version: " fullword wide
                $s11 = "Keylogger Enabled: " fullword wide
                $s12 = "Clipboard-Logger Enabled: " fullword wide
                $s13 = "\\drivers\\etc\\hosts" fullword wide
                $s14 = "fakerror" fullword ascii
                $s15 = "Operating System Platform: " fullword wide
                $s16 = "Operating System: " fullword wide
                $s17 = "process__1" fullword ascii
                $s18 = "get_OperationalStatus" fullword ascii
                $s19 = "Disablelogger" fullword wide
                $s20 = "SendLogs" fullword ascii
                $s21 = "SendLogsPHP" fullword ascii
                $s22 = "SendLogsFTP" fullword ascii
        condition:
                uint16(0) == 0x5a4d and filesize < 2048KB and all of them
}