rule Gafgyt_Fro {
	meta:
		author = "WPeace"
	strings:
		$elf = "\x7FELF"
		$authorStr = "FrostedFlakes666"
		$onlinePack = "Kansen shita"
		$commandStr_0 = "CMD"
		$commandStr_1 = "CREG"
		$commandStr_2 = "KPAC"
		$commandStr_3 = "GETPUBLICIP"
	condition:
		all of them
}