rule TinyCmdPipeRAT {
	meta:
		description = "TinyCmdPipeRAT"
		author = "LAC Co., Ltd."
	strings:
		$str1 = "%s%s.mui"
		$str2 = "endshell"
		$str3 = "InitSecurityInte"
		$mov_str1 = { 6D 33 32 5C C7 44 ?? ?? 63 6D 64 2E C7 44 ?? ?? 65 78 65 00 }
		$mov_str2 = { 63 6D 64 2E C7 45 ?? ?? 78 65 2E C7 45 ?? ?? 75 69 00 }
		$mov_str3 = { C7 85 ?? 00 00 00 43 66 67 4D C7 85 ?? 00 00 00 67 72 2E 65 66 C7 85 ?? 00 00 00 78 65 }
	condition:
		uint16(0) == 0x5A4D and (all of them)
}