rule Remcos_Core_String_Cluster : remcos triage
{
    meta:
        author = "Existing | v1olet"
        date = "2026-10-23"
        description = "Family-oriented static triage candidate; related variants not yet validated"
        scope = "Unpacked PE files; not TLS traffic or packed outer stages"
        reference_sample = "79179155729934442e02925d2a97ded40e739216352159c536c47643bfe53fda"
    strings:
        $a = "Remcos Agent initialized (" ascii
        $b = "Remcos restarted by watchdog!" ascii
        $c = "Remcos v" ascii
        $d = "Offline Keylogger Started" ascii
    condition:
        filesize < 4MB and uint16(0) == 0x5a4d and
        uint32(uint32(0x3c)) == 0x00004550 and 3 of them
}

rule Remcos_Settings_Instance_79179155 : remcos sample_specific
{
    meta:
        author = "Existing | v1olet"
        date = "2026-10-23"
        description = "Exact embedded SETTINGS key-prefix plus Remcos identity; configuration-specific"
        scope = "Recovered PE or closely preserved copies; re-keying breaks this rule"
    strings:
        $key_prefix = { 17 F6 DC 4C 85 52 07 80 5C DD 97 67 6C D4 0F CA EB 57 F9 E2 E6 41 AB 09 }
        $identity = "Remcos Agent initialized (" ascii
    condition:
        filesize < 4MB and uint16(0) == 0x5a4d and $key_prefix and $identity
}

rule Lua_Loader_ZGNICV_Combination : lua loader sample_specific
{
    meta:
        author = "Existing | v1olet"
        date = "2026-10-23"
        description = "Recovered Lua loader's decoder identifiers plus native page-protection interfaces"
        scope = "Decoded Lua source; names are sample-specific and easily changed"
    strings:
        $decoder1 = "u0Zw356QS2JN" ascii
        $decoder2 = "m0amT8SSscq8Js9M" ascii
        $api1 = "AddVectoredExceptionHandler" ascii
        $api2 = "NtProtectVirtualMemory" ascii
        $payload = "local ZGNICV" ascii
    condition:
        filesize > 1MB and filesize < 3MB and all of them
}

rule JScript_Dropper_ZGNICVGK_Combination : jscript dropper sample_specific
{
    meta:
        author = "Existing | v1olet"
        date = "2026-10-23"
        description = "Outer dropper's specific naming plus Windows script delivery interfaces"
        scope = "Submitted outer JScript; not a generic JScript malware rule"
    strings:
        $name = "ZGNICVGKWHUBRJMP" ascii
        $com1 = "ActiveXObject" ascii
        $com2 = "WScript" ascii
        $com3 = "SaveToFile" ascii
    condition:
        filesize > 1MB and filesize < 8MB and $name and all of ($com*)
}