rule osx_retefe_w0 {
    meta:
        author = "AlienVault Labs"
        type = "malware"
        description = "OSX/Dok"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/osx.retefe"
        malpedia_version = "20170602"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $c1 = "/usr/local/bin/brew"
        $c2 = "/usr/local/bin/tor"
        $c3 = "/usr/local/bin/socat"
        $c4 = "killall Safari"
        $c5 = "killall \"Google Chrome\""
        $c6 = "killall firefox"
        $c7 = "security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain %@"

    condition:
        all of them
}