GlowSpark_Downloader.rule

// see the relevant post at: https://inquest.net/blog/2022/02/10/380-glowspark
rule GlowSpark_Downloader
{
meta:

Author = inquest.net
discription = "GlowSpark_2n_Stage_Actinium_Downloader"
last_modified = "1.0"
date = 08.02.2022
    
strings:
$a1="79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116" ascii wide nocase

$a2="67,114,101,97,116,101,79,98,106,101,99,116,40,34,83,99,114,105,112,116,105,110,103,46,70,105,
108,101,83,121,115,116,101,109,79,98,106,101,99,116,34,41" ascii wide nocase

$a3="51,50,44,55,57,44,49,49,48,44,51,50,44,54,57,44,49,49,52,44,49,49,52,44,49,49,49,44,49,49,52,
44,51,50,44,56,50,44,49,48,49,44,49,49,53,44,49,49,55,44,49,48,57,44,49,48,49,44,51,50,44,55,56,44,
49,48,49,44,49,50,48" ascii wide nocase // The second stage of the script 

condition:

((filesize < 2000KB) and any of ($a*))
}