rule js_node_rat_w0 {
          meta:
            description = "detect Noderat in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html"
            source = "https://github.com/JPCERTCC/MalConfScan/blob/65159d9a558dfba3ca3faece2592a71cb51f1edc/yara/rule.yara#L427"

            malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/js.node_rat"
            malpedia_version = "20200406"
            malpedia_license = "CC BY-NC-SA 4.0"
            malpedia_sharing = "TLP:WHITE"
          strings:
            $config = "/config/app.json"
            $key = "/config/.regeditKey.rc"
            $message = "uninstall error when readFileSync: "

          condition: all of them
}