BlackEnergy 2 Yara Rule

/*

  BlackEnergy2 Yara Rule
  v1.0 19.02.15

  Tested on sample provided by @PhysicalDrive0:
  https://malwr.com/analysis/N2YxOGJkNTk5NjcwNDM1MDkxN2EwZWMzYjE2NWQ4MTU/

  Also integrated in IOC Scanner Loki
  https://github.com/Neo23x0/Loki

  Please report back false positives (via Issues on LOKI´s Github page)

*/

rule BlackEnergy_BE_2 {
    meta:
        description = "Detects BlackEnergy 2 Malware"
        author = "Florian Roth"
        reference = "http://goo.gl/DThzLz"
        date = "2015/02/19"
        hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
    strings:
        $mz = { 4d 5a }
        $s0 = "<description> Windows system utility service  </description>" fullword ascii
        $s1 = "WindowsSysUtility - Unicode" fullword wide
        $s2 = "msiexec.exe" fullword wide
        $s3 = "WinHelpW" fullword ascii
        $s4 = "ReadProcessMemory" fullword ascii
    condition:
        ( $mz at 0 ) and filesize < 250KB and all of ($s*)
}