rule crypt_constants_2 {
	meta:
		Author = "CISA trusted 3rd party"
		Incident = "10135536"
		Date = "2018-04-19"
		Category = "Hidden_Cobra"
		Family = "n/a"
		Description = "n/a"
	strings:
		$ = { EF CD AB 90 }
		$ = { 55 84 26 FE }
		$ = { 78 56 B4 C2 }
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}